1.1 Document information technology internal controls for the City Council – To protect the city’s assets and network, the City Council and the city’s Technology Services agency should work together to formally document critical Technology Services’ policies that council members and their staff will follow, including, at a minimum, those that ensure accurate tracking of the City Council’s information technology equipment and consistent completion of mandatory cybersecurity training by City Council personnel.
As part of this, the City Council and Technology Services should list the Technology Services policies that the City Council will follow and also describe the steps Technology Services will take to communicate any concerns about noncompliance and ways in which it will remedy unresolved risks that are associated with the City Council’s activities.
Agency Response – Agree, Implementation Date – March 1, 2024
1.2 Create new policies and procedures for information technology compliance – After implementing Recommendation 1.1, the City Council’s Central Office staff should create new policies and procedures to document the critical Technology Services policies the City Council will follow and the information the Central Office will provide to Technology Services to demonstrate the City Council’s compliance. These new policies and procedures, as well as the compliance commitment, should be shared with all City Council members and their office staff.
Agency Response – Agree, Implementation Date – March 1, 2024
1.3 Create policies and procedures for returning technology equipment – The City Council’s Central Office staff should create policies and procedures to better ensure all outgoing council members and staff return all city-owned information technology hardware. The procedures should include, at a minimum, a description of who is responsible for receiving and tracking the equipment, the steps to be taken to validate hardware inventories self-reported by council members’ district offices, and how often Central Office staff will request and validate hardware inventories.
Agency Response – Agree, Implementation Date – March 1, 2024
1.4 Audit and monitor the City Council’s information technology inventory – The City Council’s Central Office staff should audit its inventory of council personnel’s information technology equipment to locate and log all devices currently in use, resolve any duplicate serial numbers, and identify and correct missing location and user data. Once the inventory is corrected, Central Office staff should provide the Technology Services agency with the new inventory information and continue to monitor and identify corrections needed in Technology Services’ information technology inventory data.
Agency Response – Agree, Implementation Date – March 1, 2024
1.5 Seek a legal determination regarding acceptable financial support for local organizations – The City Council should request an opinion from the City Attorney’s Office about the legality of the City Council members’ practice of making donations, engaging in sponsorships, and executing grants with local organizations. The City Council should also get advice from the City Attorney’s Office on the limits of the “public purpose” exception as it applies to Article XI, Section 2 of the Colorado Constitution as well as obtain the legal definition of a “donation” and how it is distinct from a “sponsorship” or a “grant.”
Agency Response – Agree, Implementation Date – June 1, 2024
1.6 Update procedures on donations, sponsorships, and grants – Based on information from the City Attorney’s Office obtained as part of implementing Recommendation 1.5, the City Council should update its internal procedures to clearly define a donation, a sponsorship, and a grant. These policies and procedures should be updated to include guidance on who is responsible for keeping donation declaration forms in line with the city’s records retention policy.
Agency Response – Agree, Implementation Date – Jan. 17, 2024
1.7 Develop and deliver training on support for local organizations – In consultation with the Department of Finance or the City Attorney’s Office, as necessary, the City Council’s Central Office staff should develop and provide training for council members and their staff on the distinction between donations, sponsorships, and grants. This should include how to record such transactions both in Workday and on donation declaration forms and how to report these to the Clerk and Recorder’s Office.
Central Office staff should also determine and document how often refresher training should be provided. Council members’ and employees’ completion of this refresher training should be documented and tracked by the Central Office.
Agency Response – Agree, Implementation Date – Jan. 17, 2024
1.8 Update internal procedures after update to city fiscal rules – The City Council should monitor potential changes to the city’s Fiscal Accountability Rules regarding donations and adjust the council’s policies and procedures accordingly to ensure compliance.
Agency Response – Agree, Implementation Date – Jan. 31, 2024
1.9 Update donation declaration form – The City Council’s Central Office staff should update the donation declaration form so that it includes instructions on when and how the form should be submitted before council members make or promise taxpayer funds to local organizations, in alignment with the City Council’s internal procedures.
Additionally, Central Office staff should revise the form to require additional detail about the supporting documentation that council members must provide to better explain, as applicable:
- How a donation serves a public purpose.
- Where, when, and how the marketing benefit for a sponsorship will be realized.
- The name and a brief description of the grant being given.
Agency Response – Agree, Implementation Date – Jan. 17, 2024
1.10 Review City Council members’ financial support of local organizations to monitor compliance – The City Council’s Central Office staff should annually review the Clerk and Recorder’s Office’s donation reports as well as Workday transactions to identify patterns of noncompliance with City Council members’ financial support of local organizations. This review should be documented and include inspections of supporting documentation to ensure transactions adhere to the City Council’s policies and procedures.
Even if the practice of donating funds from council members’ district budgets is no longer allowed because of upcoming changes to the Fiscal Accountability Rules, Central Office staff should continue reviewing sponsorships and grants made by council members’ districts to ensure these activities comply with city rules.
Agency Response – Agree, Implementation Date – Jan. 31, 2025
1.11 Track purchase card training – The City Council’s Central Office staff should develop a documented process to track when purchase cardholders among council members and their staff complete the required Workday training on purchase card use. Because the training can be retaken at any time, Central Office staff should also determine when a refresher training should be provided to cardholders and track their completion of this training.
Agency Response – Agree, Implementation Date – June 1, 2024
1.12 Periodically review purchase card activity – The City Council’s Central Office staff should regularly review council members’ and staff’s purchase card use through Workday to identify patterns of noncompliance. This should include checking for potential split transactions and computer technology purchases, as well as verifying that payments to local organizations using purchase cards are indeed sponsorships, not donations.
Any identified patterns of noncompliance should be documented and used to inform how often the refresher training described in Recommendation 1.11 should be required .
Agency Response – Agree, Implementation Date – Jan. 31, 2024
1.13 Revisit the fiscal policy for election year purchasing – The City Council’s Central Office staff should revisit the council’s fiscal policy for election year purchases to determine whether any additional steps are needed — such as improved controls or adjusting the timing for disabling purchase cards and travel cards. Central Office staff should document their decision to revise or update the fiscal policy and ensure they adhere to the fiscal policy going forward.
Agency Response – Agree, Implementation Date – March 1, 2024
1.14 Create formal policies and procedures to ensure keys and badges are returned – The City Council’s Central Office staff should develop and implement formal policies and procedures to ensure outgoing council members and staff return their keys and badges by the date set by the Central Office. The procedures should include, at a minimum, a description of who is responsible for collecting keys and badges, how staff will track and document when keys and badges are turned in, who outgoing members and staff should turn them in to, and what steps Central Office staff will take to collect them, if necessary.
Agency Response – Agree, Implementation Date – March 1, 2024