Loading...
HomeMy WebLinkAboutAudit Reports - Public - Internal Audit for Technology Innovation Projects - 8/31/2025©2025 CliftonLarsonAllen LLP | 1 City of Glendale, Arizona Internal Audit for Technology Innovation Projects August 2025 – Final Report Prepared by: Jeff Ziplow, Principal Lindsey Intrieri, Manager Matt Folger, Senior CliftonLarsonAllen LLP 29 South Main Street 4th Floor West Hartford, CT 06107 CLAconnect.com CPAs | CONSULTANTS | WEALTH ADVISORS CLA (CliftonLarsonAllen LLP) is an independent network member of CLA Global. See CLAglobal.com/disclaimer. Investment advisory services are offered through CliftonLarsonAllen Wealth Advisors, LLC, an SEC-registered investment advisor. ©2025 CliftonLarsonAllen LLP | 2 Table of Contents Contents Project Overview ......................................................................................................................... 3 A. Background .............................................................................................................................3 B. Project Approach & Tasks .......................................................................................................3 C. Acknowledgements .................................................................................................................3 D. Commendations ......................................................................................................................3 Glendale Innovation Technology Projects Background ................................................................. 4 Overall Audit Conclusion ............................................................................................................. 7 Testing ........................................................................................................................................ 8 Findings and Recommendations .................................................................................................. 9 Management Comments ........................................................................................................... 10 A. Interviewees ..........................................................................................................................11 ©2025 CliftonLarsonAllen LLP | 3 Project Overview A. Background The City of Glendale (hereinafter also referred to as “The City”) engaged CliftonLarsonAllen LLP (hereinafter referred to as “CLA”) to perform an Internal Audit of the Innovation Technology Projects. B. Project Approach & Tasks This assessment included the following tasks and activities: 1. Assess how IT projects are determined, prioritized, staffed, funded, and managed. Assess scope and timeliness of project milestones and completion. Where possible, measure effectiveness of results. 2. Document findings and operational/control gaps observed. 3. Provide management with a report of our findings and recommendations. 4. Meet with management to review the results of our report. C. Acknowledgements CLA would like to thank the City staff for their participation, support, on-going dialogue, and feedback during this internal audit. D. Commendations The Glendale Innovation and Technology Department has actively been working to standardize the management and processes of IT projects within the City. A number of templates have been created and updated to help govern IT projects. CLA noted that after this audit commenced, the PMO added required milestones to their current project management tool, Meisterplan, for each project template. This is intended to increase accountability for the completion of required project milestones and allow for greater visibility by PMO management. Additionally, the PMO has begun an internal benchmarking procedure to confirm the consistency of their own services and support provided to IT projects in the City. ©2025 CliftonLarsonAllen LLP | 4 Glendale Innovation Technology Projects Background Below is a description of the systems used by the City and the technology employee roles and responsibilities. 1. Technology Systems and Tools a. Meisterplan i. Project and portfolio resource management software used to track resources for any projects with over 40 hours of resource need. ii. As projects are identified, they are added to the Meisterplan system. iii. This tool will be phased out in the near future as it has not been ideal for tracking projects for the project management team. b. Brightwork i. Project and portfolio management system. ii. This will be replacing Meisterplan as it offers additional key performance indicators (KPIs), data reporting, and project metrics for the IT team. c. Tyler Technologies Enterprise ERP - Project and Grant Accounting Module i. Subsidiary module of financial management system to record and manage project details. Interfaces directly with the City’s general ledger. d. Microsoft Excel i. Used for additional project management and budget tracking. e. Microsoft Teams Planner i. Digital Kanban board interface for task management (visualizes the project workflow by breaking down projects into stages as representative columns on the board). f. Microsoft Project i. Project management software. Includes scheduling, resource allocation, progress tracking, budget management, and workload analysis. ii. This is used for “high-level” planning on some projects, not uniformly used by the Project Management team. g. Microsoft Visio i. Diagramming and flowchart tool. 2. Roles and Responsibilities a. The technology department responsible for project management of City IT projects is referred to as the Innovation and Technology Department. Operational projects (outside of the Project Management Office (PMO) are managed by the City Operations personnel. ©2025 CliftonLarsonAllen LLP | 5 b. IT PMO Manager i. Responsible for oversight of the PMO team and development of IT project management procedures. The PMO Manager also performs project management duties for specific or complex larger IT projects. c. Business Analyst i. Responsible for gathering project requirements and supporting documents, creating project workflows, performing any business use tests, training documents, and serving as the business coordinator of IT projects. d. IT Project Manager i. Responsible for completion of required PMO documentation (including the project charter, statement of work, purchase orders, invoice processing, project closeout, and reports) and facilitation of their assigned IT projects. The Project Managers provide direction to project team members with tasks and assignments and are responsible for managing resources with assistance from the PMO Manager. e. IT Project Coordinator i. Responsible for management of smaller projects including the completion of action logs, project follow up, and status reports. This position is administrative in nature, rather than technical. Initial Project Proposal Process Background a. Project proposals that are not a part of the regular budget cycle are funded utilizing grant funds or other department/operational funds that do not require additional appropriations. i. Departments notify IT via the ticketing system, an email or direct phone call. These projects may go through a technology review. ii. The technology review process involves IT verifying that a project’s technology is approved to function within the city’s environment. IT issues a formal Approval Letter, then the project can proceed with TGC prioritization. iii. Project requests outside of the regular budget cycle currently follow a different intake process. b. Project proposals that require funding are a part of the regular budget cycle and require approval from the Technology Governance Committee (TGC). i. The business unit, or requestor, must complete a formal document/template, the Technology Governance Committee Request. This includes the business case for the project and identifies the project sponsor, project overview, impacts, costs, and other details. A Business Analyst will work with the business unit, or requestor, to gather any additional information needed. ii. The PMO reviews the Technology Governance Committee Request for resource needs prior to submission to the TGC. The PMO characterizes the project as either required, recommended, (etc.) and presents the recommendations to the TGC. iii. When the TGC meets, the business unit or requestor presents their project proposal. The TGC votes to recommend (or not recommend) the project to the City Manager’s Office. The City ©2025 CliftonLarsonAllen LLP | 6 Manager’s Office will then further refine the project list for the city council to make the final approval decision. Projects will then be prioritized and added to the upcoming budget cycle. • The City has been working to develop a uniform scoring process for establishing the recommended project list. Project categories have been developed so far, but the new complete scoring process has not yet been established. Project Scoping and Budget Process Background a. Once a project is approved, the IT PMO manager will solicit guidance on where the new project falls based on department priority, complexity, availability of resource needs, and other factors. Once project priority is established, an assigned Project Manager works with the business unit or requestor to complete a Project Charter that defines project goals, scope and roles and responsibilities. b. The estimated cost of the project is included in the initial TGC request, but after final approval, a detailed budget is defined. Project Managers encumber funds at the start of each fiscal year for their approved projects. There is a Contingency Fund that can be utilized for any projects that may need additional funding, however, the TGC must approve the transfer of contingency funds to the project. If necessary, a project may be placed on hold until additional funds are obtained. i. If a project is completed and additional funds remain, the remaining funds can be transferred to the Contingency Fund with TGC approval. ii. A new key performance indicator (KPI), project spend rate, is now tracked by the City. The spend rate of each project is tracked and reported to the TGC as part of the Portfolio Management & Resources Optimization Update.). Project Tracking and Closeout Process Background a. During each TGC meeting, the PMO Manager provides updates on all IT-related projects including existing and open projects, those nearing conclusion, and the list of projects they recommend should begin. b. Project status meetings occur with the entire project team weekly or biweekly (depending on the complexity and nature of the project). Depending on the project, and if necessary, projects status reports are made to the executive team weekly or monthly. c. Project Managers utilize excel spreadsheets to track the project budget and the Enterprise ERP Project Module to reconcile the project expenses. d. Project changes are made using the Project Change Request Template and the requests are submitted to project executive team or project sponsor. If additional funding is required, it is presented to the TGC for approval. e. At the completion of the project, a meeting is held to discuss any lessons learned from the project. Not all projects require the completion of a lessons learned meeting. f. Closure/final reports are completed at the conclusion of projects, for most, but not all, projects (depending on project complexity and nature). As part of the closeout, the project team completes a “lessons learned” writeup. g. Currently, project reporting is a manual effort performed by the Project Manager. The City would like to standardize and automate project progress and closing reports in the future using Brightwork and/or ©2025 CliftonLarsonAllen LLP | 7 artificial intelligence (AI) and other automated tools to summarize and capture project lessons learned, risks, business case information, schedules, constraints, etc. Overall Audit Conclusion As part of this audit, CLA tested processes related to the project management of City IT Projects. For each area tested, CLA assessed the control for effectiveness and provided an audit conclusion of “Satisfactory,” “Needs Improvement,” “Unsatisfactory,” “Inconclusive,” or “Not Applicable.” CLA determined an overall audit rating of “Needs Improvement” due to a lack of standardization around the requirements of Technology and Innovation projects. Audit Conclusion Key Conclusion Rating Rating Calculation/Logic Satisfactory 90-100% of the samples selected for testing passed the test criteria with no exceptions Needs Improvement 75% - 89% of the samples selected for testing passed the test criteria; exceptions were noted Unsatisfactory 74% or less of the samples selected for testing passed the test criteria; exceptions were noted Inconclusive Audit test files and/or supporting documents were not available during testing; unable to conclude on testing results Not Applicable Testing was not applicable for the selected control ©2025 CliftonLarsonAllen LLP | 8 Testing CLA sampled 13 IT projects since 2022 to test their accordance with the established IT project policies and adherence to PMO standards. Control Test CIP Project Internally Funded PMO Project The Technology Governance Request Form was Completed Not Applicable Not Applicable 4 of 4 projects received TGC approval If TGC Approval Wasn’t Needed, Project was Communicated and Approved by IT. 2 of 4 projects received IT Approval 0 of 2 projects that needed IT approval were approved by IT Not Applicable A Project Charter was Completed Not Applicable 3 of 5 projects selected had a charter 3 of 4 projects selected had a charter Project Budget was Created and Tracked Not Applicable Not Applicable 2 of 4 projects had a budget for the project that tracked expenditures Project Funds were Encumbered 3 of 3 projects that required funds were encumbered 1 of 1 project that required funds were encumbered 4 of 4 projects had project funds encumbered Risk Register was Completed Not Applicable 1 of 5 projects had a risk register 1 of 4 projects had a risk register Project Change Request was Submitted and Approved Not Applicable 1 of 1 project that required a change had the change request approved 1 of 1 project that required a change had the change request approved Status Reports were Made 4 of 4 projects held status report meetings 2 of 5 projects held status report meetings 4 of 4 projects held status report meetings Lessons Learned Document was Completed Not Applicable 1 of 5 projects completed a lessons learned session. This was not a requirement in the testing period. The 1 project that was completed did not have a lessons learned session. This was not a requirement in the testing period. Closure Report was Completed Not Applicable 1 of 5 projects completed a closure report The 1 project that was completed did not have a closure report ©2025 CliftonLarsonAllen LLP | 9 Findings and Recommendations Below are the identified findings and recommendations as a result of CLA’s assessment of the Glendale IT Project Management Office. 1. Finding – City IT Projects Do Not Consistently Adhere to the Same Project Management Procedures a. IT projects do not currently follow the same processes depending on the funding source or department that is responsible for the project’s completion. I. IT projects completed through the City’s Capital Improvement Plan (CIP) follow a different project vetting and approval process, and do not always involve the PMO. The PMO is only responsible for IT portions, or components, of CIP projects. Project planning and management for the CIP projects are typically handled by the Engineering office. In some cases, the PMO should be involved in the early stages of CIP projects where there are technology implications, but they are not always included timely. II. Internally-funded projects do not require TGC approval and also have limited involvement by the PMO unless the project introduces new or changed technology. b. As identified in CLA’s sample testing, all sampled projects did not follow the established PMO procedures. Sampled projects did not have centralized file locations accessible to all members of the PMO team, which resulted in missing project files. c. Without a consistently applied project management approach, and oversight, it can be increasingly difficult for the City to uniformly measure and track projects. 1. Recommendation – Develop, and Require Standard IT Project Management Procedures for All City IT Project Types a. The Project Management Office should develop detailed procedures to document the required steps each identified IT project type must follow. Exceptions to the standard IT PMO process should have documented exception memos that receive approval from management. b. Templates in Brightwork, the new Project Portfolio Management (PPM) system, should be developed based on the specific project types to track all required tasks for the project. Notes/documentation should be uploaded for any identified exceptions or deviations from the required project management steps. c. A centralized repository should be utilized to store all project documentation for each IT project to allow for greater transparency and consistency. A centralized file repository will allow for management to verify that necessary steps are completed by PM’s and provide for greater auditability of projects. This also allows PMs to reference previous projects that may be applicable/relevant to the current projects they are managing. d. Expected Outcome of Recommendation: Implementing a standard project ©2025 CliftonLarsonAllen LLP | 10 management approach will bring Glendale several strategic and operational benefits including i. Consistency and transparency across projects – a standard process for planning, budgeting, executing, and project reporting. ii. Improved accountability – standard documentation to simplify audit and evaluation of projects and clear roles and responsibilities. iii. Better resource allocation – identifies any project overlaps and opportunities to resource share, reduces waste. iv. Risk management – an easier way to anticipate and address project risks and issues before escalation. v. Enhanced communication – commonly used documents and collaboration tools, meetings, and reports. vi. Performance measurement – consistently monitored KPIs. Management Comments CLA obtained management comments from the Project Management Office in response to the control findings and recommendations. 1. Recommendation – Develop, and Require Standard IT Project Management Procedures for All City IT Project Types PMO Management Response: a. Concur. IT PMO will develop detailed procedures to document the required steps each identified IT project type must follow by March 30, 2026. Once adopted, the new procedure will require exceptions to the standard IT PMO process to have a documented exception memo approved by IT management. b. Concur. IT PMO will develop templates based on the specific project types to track required tasks for the project by March 30, 2026. The procedures noted in “a” above will address where notes/documentation should be uploaded for any identified exceptions or deviations from the required project management steps. c. Concur. The IT PMO currently utilizes SharePoint as a central repository for project documents. However, staff does not currently consistently update SharePoint. As part of the procedures noted in “a” above, staff will be required to update SharePoint at project closure (March 2026). Additionally, this requirement has been added to all IT Project Managers FY26 Performance Management Goals. ©2025 CliftonLarsonAllen LLP | 11 A. Interviewees CLA interviewed the following Glendale IT/PMO employees as part of this internal audit. Arlene Chemello, Deputy Chief Information Officer Donna Sanchez, PMO Manager Sara Ainsworth, IT Project Manager