Meeting_Body
FINANCE, BUDGET, AND AUDIT COMMITTEE
MAY 21, 2026
Subject
SUBJECT: FISCAL YEAR 2027 AUDIT PLAN
Action
ACTION: APPROVE RECOMMENDATION
Heading
RECOMMENDATION
Title
ADOPT the Fiscal Year 2027 (FY27) Proposed Annual Audit Plan (Attachment A).
Issue
ISSUE
Management Audit Services (MAS) is required to complete an annual agency-wide risk assessment and submit an annual audit plan (AAP) to the Board of Directors for approval.
Background
BACKGROUND
The Financial Stability Policy, approved in 2007 and last amended in 2022, requires MAS to develop a risk assessment and an AAP each year and present it to the Board. It also requires the Finance, Budget, and Audit Committee to provide input and approve the audit plan.
Some projects included in the FY27 AAP are identified as carryovers, meaning they were initiated in FY26 but are expected to be completed during the first quarter of FY27.
Discussion
DISCUSSION
The FY27 AAP was developed with consideration of the current state of the agency and the results of the agency-wide risk assessment. The agency-wide risk assessment incorporated research as well as input received from leadership teams across the agency. MAS leveraged the risk assessment results to prepare an AAP that is flexible, relevant, and risk based. The AAP includes audit projects that add value and support agency risk management efforts and the achievement of agency goals. The agency goals, objectives and desired outcomes considered in the preparation of the FY 27 AAP include those in Metro's Vision 2028 Strategic Plan, the CEO’s FY26 priority initiatives, and the One Metro Strategic Implementation Plan.
Risk Assessment
MAS staff performed an agency-wide risk assessment between January and April 2026. This assessment is a structured, systematic process that combines research and stakeholder engagement and is the foundation for selecting internal audit projects that add value and support the agency’s objectives. The identified risks varied in nature, the likelihood of occurrence, and their potential impact on the agency. The agency-wide risk assessment also identified potential future opportunities related to the agency’s goals and objectives.
To help MAS understand the various risks the agency currently faces and their potential impacts, the following guiding principles were considered:
• Identification of auditable units
• Identification of potential risks, including emerging risks
• Categorization of identified risks
• Assessment of the likelihood of identified risks
• Assessment of the impact of identified risks
The following risk categories were considered in the performance of the agency-wide risk assessment:
• Capital Project
• Compliance
• Environmental, Social, and Governance
• Financial
• Human Capital
• Information Technology
• Legal / Regulatory
• Operational
• Public Image / Reputational
• Reporting
• Safety / Security
Enterprise Risk Themes
The agency-wide risk assessment led to the identification and discussion of core enterprise-risk themes. Not all risks identified as part of the agency-wide risk assessment process led to the inclusion of an audit project in the AAP. This is due to factors such as timing, robust management initiatives in the area, and the need to prioritize audit efforts given limited audit resources. Six core risk themes identified are summarized below:
• Staffing: Leadership across departments emphasized that employee retention and wellness remain critical, particularly given increased workloads associated with approaching mega events and the anticipated completion of various key projects in the near term. Concerns were also raised that budget constraints may limit the hiring needed to support service delivery across an expanding rail network. Some suggested exploring alternatives to promotions for rewarding employees’ high performance to avoid an imbalance in the workforce and prevent the agency from becoming top-heavy with too many layers of management. Others highlighted the importance of accelerating the hiring of entry-level talent to sustain the agency in the future. Mitigating some of these concerns are new recruitment strategies aimed at improving candidate selection and employment offer timelines for staff who will support the capital improvement program. There are also nascent internship and entry-level trainee programs for non-contract staff.
• Public Safety: During FY26, TAP-to-Exit resumed at both Union Station and the North Hollywood Station and expanded to the Pomona Station. Pilot testing of weapons detection systems at select rail stations is ongoing, with continued exploration of a similar pilot for buses. The agency also launched an online safety hub to provide information on efforts to protect employees and customers. Another milestone was the completion of phase 1 of the three-phase implementation of the Department of Public Safety (DPS), with phase 2 underway and including resource planning, recruitment, and training. The DPS care-based services division was launched, with Metro Ambassadors, Home Team, and Community Intervention Specialists transitioning into it. Key challenges include developing crisis response teams within the care-based services division, developing policy for the police services division, and creating a comprehensive hiring and recruitment strategy. The formation of DPS will also require compliance with new legal provisions. To support public safety efforts, MAS has included a carry-over project to analyze controls for physical security monitoring equipment and enhance customer and employee safety.
• Operational (Funding Constraints): Hosting the 2026 FIFA World Cup, Super Bowl LXI, and the Summer 2028 Olympic and Paralympic Games remains a priority alongside delivering core transit services. The D Line Extension Section 1 opening is highly anticipated, and progress continues on the Games Enhanced Transit System, a temporary supplementary transit system created to ensure reliable spectator and workforce transit during the 2026 FIFA World Cup. Achievement of the 2028 Mobility Concept Plan, including ensuring sufficient bus availability during the Games, is also top of mind. Federal funding commitments for the Games for operational activities have not yet been granted. As the rail network expands, operations and maintenance costs grow faster than available funding, a gap compounded by limited sales tax revenues dedicated to operations. To help control operations and maintenance costs, the agency is also exploring predictive maintenance strategies for right-of-way and rolling stock.
• Capital Projects: The agency is focused on delivering large capital projects tied to voter approved sales tax Measures R and M. The value of projects in development and implementation increased from $25.7-$27.2 billion in FY25 to $33.7-$35.9 billion in FY26. Efforts continue to recruit new talent and to develop emerging talent to support the program, alongside recruitment efforts to rebalance the staff-to-consultant ratio to control costs and retain institutional knowledge. Price volatility in materials, labor shortages, and limited contractor supply pose cost escalation risks. Lessons learned from past projects underscore the importance of evaluating and selecting the right project delivery method for each project's risk profile, as well as using alternative project delivery methods where appropriate. The North Hollywood to Pasadena Bus Rapid Transit, Vermont Transit Corridor, G-Line Bus Rapid Transit, East San Fernando Valley Transit Corridor, and the Southeast Gateway Line are all using alternative delivery methods. As more Metro projects are expected to be delivered using collaborative delivery methods in the future, such as construction manager/general contractor and progressive design-build, these approaches present both risks and opportunities for the agency. To help provide assurance in this area, the AAP includes as priority projects: oversight for the Planning Phase of Capital Project Management, and Metro’s North Hollywood to Pasadena Bus Rapid Transit project.
• Financial: Near- and long-term financial challenges have been a focus of the Board over the past three years and are top-of-mind for leadership across the agency. Annual deficits are projected to widen from FY28 through FY30, with labor, fuel, energy, and capital investment costs outpacing sales tax revenue growth. A significant cost driver is labor. Shifts in Federal Transit Administration priorities, geopolitical conflicts, and the declining population in Los Angeles County present additional financial risks. The agency is exploring policy options to refocus unrestricted resources on core bus and rail operations. Third-party risk management is also critical during this period to limit financial exposure and to help ensure third parties effectively and efficiently deliver the services for which they receive funding. To help provide assurance in this area, the AAP includes as priority projects a performance audit of Access Services compliance and reporting, and an audit of Minimum Annual Guarantee agreements to support revenue enhancement opportunities.
• Environmental, Social, and Governance Risk: The agency continues to explore ways to strengthen its cybersecurity posture by expanding efforts to prevent, detect, and respond to cyber incidents including utilization of the latest tools, techniques, and methods. To support these efforts, a new continuous IT audit initiative is included in the AAP to help provide ongoing assurance in the IT area.
There are also unique risks that do not clearly fit into one of the outlined major risk categories, as well as risks that may not have been identified or presented during the agency-wide risk assessment. MAS will continue to assess emerging risks throughout FY27 and, if necessary, adjust the AAP.
Audit Plan
The FY27 Audit Plan is based primarily on the results of the agency-wide risk assessment.
Scores were assigned to individual risks in our risk assessment, with consideration given to the potential likelihood and impact. Identified risks are ranked through assessing the potential severity of a risk event and the probability of its occurrence. This assessment helps prioritize audit focus by assigning high-risk scores, which lead to the selection of projects for inclusion in the FY27 plan. The risk scores associated with the newly identified priority projects for FY27 are displayed in Exhibit 1.
Exhibit 1:
FY27 Annual Audit Plan Projects Heat Map
Risk scores were not the only guide used by MAS to select audit projects for the FY27 Audit Plan. Additional factors considered included:
• Perceived strength of management controls
• Prior audits or reviews
• Subject matter expertise/capacity required by MAS to perform an audit or review
• Complexity of the risk area
• Input from senior leadership
Accordingly, the Audit Plan includes audit projects to address areas of moderate to high risk that are expected to add value, mitigate potential future risks, and support the achievement of agency goals and objectives.
Outreach was made to the agency’s Senior Leadership Team during the selection of audit projects included in the FY27 Audit Plan to solicit feedback and suggestions on the proposed work. The feedback received was considered and incorporated into the FY27 Proposed Annual Audit Plan (Attachment A).
The FY27 Proposed Annual Audit Plan includes 13 audit projects in three categories: priority, discretionary, and carryover.
• Priority: Audit projects that will be given primary focus during FY27.
• Discretionary: Audit projects that MAS will perform based on the status of priority and carryover projects, and time and resources permitting.
• Carryover: Audit projects initiated in FY26 and will be completed in FY27.
The FY27 Proposed Annual Audit Plan also includes the required Contract and Financial Compliance Audits throughout the year. These audits include contract pre-award and incurred cost audits as requested by Vendor/Contract Management, incurred cost audits of various grant projects, and external financial and compliance audits of Metro and sub-recipients.
Professional audit standards and leading practices suggest that the agency is best served by a dynamic audit plan that can be modified in response to changing business conditions, the discovery of new information, or areas being elevated to priority status based on the needs of the Board of Directors, Chief Executive Officer, and/or senior leadership.
Determination_Of_Safety_Impact
DETERMINATION OF SAFETY IMPACT
Approval of this item will not negatively impact the safety of Metro patrons or employees.
Financial_Impact
FINANCIAL IMPACT
There are no financial impacts associated with the approval of the FY27 Audit Plan.
Equity_Platform
EQUITY PLATFORM
The FY27 agency-wide risk assessment and audit plan include conditions that could negatively impact the rider experience. At least three projects in the FY27 Proposed Annual Audit Plan were included, in part, based on these factors. These projects include the Access Services Quarterly Reporting Review, Access Services Fleet Management, and American with Disabilities Act (ADA) Improvements Projects. Also, in applying an equity lens to the FY27 AAP, MAS will ask departments during the audits whether any applicable and required Metro equity assessments have been completed.
Vehicle_Miles_Traveled _Outcome
VEHICLE MILES TRAVELED OUTCOME
VMT and VMT per capita in Los Angeles County are lower than national averages, the lowest in the SCAG region, and on the lower end of VMT per capita statewide. These declining VMT trends are due in part to Metro’s significant investment in rail and bus transit.* Metro’s Board-adopted VMT reduction targets align with California’s statewide climate goals, including achieving carbon neutrality by 2045. To ensure continued progress, all Board items are assessed for their potential impact on VMT.
As part of these ongoing efforts, this item is expected to contribute to further reductions in VMT. While this item does not directly encourage taking transit, sharing a ride, or using active transportation, it is a vital part of Metro operations, since it describes areas to be reviewed in FY27 by MAS with the goal of promoting effective and efficient operations and continuous improvement within the organization. Because the Metro Board has adopted an agency-wide VMT Reduction Target, and this item generally supports the overall function of the agency, this item is consistent with the goals of reducing VMT.
**Based on population estimates from the United States Census and VMT estimates from Caltrans’ Highway Performance Monitoring System (HPMS) data between 2001-2019.
Implementation_of_Strategic_Plan_Goals
IMPLEMENTATION OF STRATEGIC PLAN GOALS
Approval of this item supports Metro Vision 2028 Goal #5: Provide responsive, accountable, and trustworthy governance within the Metro organization. The projects included in the Audit Plan directly or indirectly support various goals outlined in Metro’s Vision 2028 Strategic Plan, the CEO’s FY26 priority initiatives, and the One Metro Strategic Implementation Plan.
Alternatives_Considered
ALTERNATIVES CONSIDERED
An alternative is not to approve the FY27 Proposed Annual Audit Plan. This is not recommended, as it is a management tool for systematically assigning resources to deliver an agency-wide audit plan in accordance with the Financial Stability Policy. Additionally, developing an annual internal audit plan is consistent with the MAS Audit Charter and Generally Accepted Government Auditing Standards.
Next_Steps
NEXT STEPS
Upon Board approval, MAS will develop the FY27 Annual Audit Plan schedule and deliver quarterly status reports to the Board.
Attachment
ATTACHMENT
Attachment A - FY27 Proposed Annual Audit Plan
Prepared_by
Prepared by: Kimberly L. Houston, Deputy Chief Auditor, (213) 922-4720
Alfred Rodas, Senior Director, Audit, (213) 922-4553
Reviewed_by
Reviewed by: Sharon Gookin, Deputy Chief Executive Officer, (213) 418-3101
