Safety and Security of City Facilities Follow-up

Photos: Denver City Council Building.

 

The city fully implemented nine recommendations made in the original audit report. The Mayor’s Office worked with other responsible city agencies to develop a strategic plan for ensuring safety and security of city facilities and to define roles and responsibilities. Additionally, the city updated two of three relevant executive orders and it has better processes to educate staff on evacuation and drill procedures.

Graphic showing nine fully implemented recommendations, seven partial, and seven not implemented

Remaining Risks

The 14 recommendations the city did not fully implement present several lingering risks. Among them:

  • The city has yet to complete vulnerability assessments, despite some initial planning for them. The Department of General Services said the assessments are time-consuming and officials intend to request more resources in 2024. Until then, the city risks being uninformed of each facility’s unique threat environment and it may not prepare appropriate countermeasures. While the city has made changes to some safety practices since the original audit, the lack of a structured approach to completing vulnerability assessments means the city continues to implement security efforts in reaction to specific incidents rather than proactively identifying risks.
  • The city is still not ensuring some employees are appropriately trained on evacuation and drill procedures. Neither the Fire Department nor the city’s risk management division have a way to ensure all facility safety administrators complete the department’s new certification program for evacuation and emergency response training. Additionally, the Fire Department is still not tracking data related to drills, and it also has not reviewed and approved facility emergency procedures guides.
  • The city’s many different systems for identity, credential, and access management are still not integrated, hampering consistent oversight. Former city employees might still be able to access city facilities after they leave their jobs.
  • General Services still does not have documented policies and procedures or required training to ensure its contract monitoring staff consistently monitor the performance of the city’s contracted security services provider. While the city is giving more oversight for its new security services provider than its previous one, the city remains at risk of not receiving all services in line with its contract.

Auditor's Letter

February 2, 2023

In keeping with generally accepted government auditing standards and Auditor’s Office policy, as authorized by city ordinance, we have a responsibility to monitor and follow up on audit recommendations to ensure city agencies address audit findings through appropriate corrective action and to aid us in planning future audits.

After following up on the “Safety and Security of City Facilities” audit report issued in June 2020, we determined the city fully implemented only nine of the 23 recommendations it agreed to. The other 14 are either partially or not implemented.

During the original audit, we found the city had not sufficiently prioritized city facility safety and security and that some existing initiatives were inadequate. For example, we found the city lacked a formal approach to performing and evaluating vulnerability assessments and it was not adequately educating employees on evacuation and drill procedures. We also found the city was not always receiving security services in line with the city’s contract or leading practices.

Based on our follow-up work, we determined the city did not fully address all the risks associated with our initial findings. Consequently, we may revisit these risk areas in future audits to ensure the city takes appropriate corrective action.

We appreciate the leaders and team members in the Mayor’s Office, the Department of General Services, the Department of Finance, the Office of Emergency Management and Homeland Security, the Department of Public Safety, and the Office of Human Resources who shared their time and knowledge with us throughout the audit and the follow-up process. Please contact me at 720-913-5000 with any questions.

Denver Auditor's Office

Auditor's Signature
Timothy O'Brien, CPA

Tim_mug.png

AUDITOR TIMOTHY O'BRIEN, CPA
Denver Auditor


Denver Auditor´s Office

Back to top