Meeting_Body
FINANCE, BUDGET, AND AUDIT COMMITTEE
JULY 18, 2025
Subject
SUBJECT: FISCAL YEAR 2026 AUDIT PLAN
Action
ACTION: APPROVE RECOMMENDATION
Heading
RECOMMENDATION
Title
ADOPT the Fiscal Year 2026 (FY26) Proposed Annual Audit Plan (Attachment A).
Issue
ISSUE
Management Audit Services (MAS) is required to complete an annual agency-wide risk assessment and submit an annual audit plan to the Board of Directors for approval.
Background
BACKGROUND
The Financial Stability Policy, approved in 2007 and last amended in 2022, requires MAS to develop a risk assessment and an annual audit plan (AAP) each year and present it to the Board. It also requires the Finance, Budget, and Audit Committee to provide input and approve the audit plan.
Some projects included in the FY26 AAP are identified as carryovers, meaning they were initiated in FY25 but are expected to be completed in FY26. These projects were not initiated due to resource constraints and additional special review projects requested during FY25.
Discussion
DISCUSSION
The FY26 AAP was developed with consideration of the current state of the agency and results of the agency-wide risk assessment. The agency-wide risk assessment incorporated research as well as input received from Metro's leadership teams across the agency. MAS leveraged the risk assessment results to prepare an Audit Plan that is flexible, relevant, and risk-based. The Audit Plan includes audit projects that add value, provide actionable information to support agency risk management efforts, and will lead to the achievement of organizational goals aligned with Metro's Vision 2028 Strategic Plan and the CEO 2023 strategic aspiration placemat.
Risk Assessment
MAS staff performed an agency-wide risk assessment between January and April 2025. This assessment is a structured, systematic process that combines research and stakeholder engagement, serving as the primary basis for selecting internal audit projects that add value and support the agency’s objectives. The recognized risks varied in nature, the likelihood of occurrence, and their potential impact on the agency. The agency-wide risk assessment also identified areas of potential future opportunity related to the agency’s goals and objectives.
To help MAS understand the various risks the agency currently faces and their potential impacts, MAS incorporated the following foundational principles in the development of the FY26 Audit Plan, which include:
• Identification of auditable units
• Identification of potential risks, including emerging risks
• Categorization of identified risks
• Assessment of the likelihood of identified risks
• Assessment of the impact of identified risks
The following risk categories were considered in the performance of the agency-wide risk assessment:
• Capital Project
• Compliance
• Environmental, Social, and Governance
• Financial
• Human Capital
• Information Technology
• Legal / Regulatory
• Operational
• Public Image / Reputational
• Reporting
• Safety / Security
Enterprise Risk Themes
The agency-wide risk assessment process led to the identification of the core enterprise-risk themes summarized below:
• Staffing: Metro leadership across departments expressed concerns about strategic workforce planning efforts. The anticipated completion of various critical projects will require sufficient and adequately trained staff to support service delivery on an expanded rail network. Additionally, the continued development of the Transit Community Public Safety Department is expected to result in a significant increase in staffing levels within a relatively short period, as will the transition of the Ambassador Program from a contracted service to an agency unit. However, the Chief People Office has made significant progress in recruitment activities since the risk assessment interviews were conducted. The CPO initiated a talent acceleration initiative that significantly reduced agency time to hire, lowered the vacancy rate to within acceptable industry standards, filled all existing positions for expansion roles, and enhanced its recruitment technology by adopting NEOGOV, a public sector recruitment platform. Continued progress in this area is underway to address Metro leadership feedback in the areas of training and development. With the opening of Metro’s Talent Hub, a new high-tech professional development training space, CPO can deliver staff training beyond courses mandated by law or regulation and offer career-forward workshops aimed at sharpening skills to build career pathways for employees. As staff vacancies are being filled, MASD proposes examining administrative improvements to review and identify procedural efficiencies and technological options within the Bus Divisions to increase productivity.
• Public Safety: Progress has been made in this area, including the hiring of the Chief of Police and Emergency Management to lead the establishment of the Transit Community Public Safety Department. The Emergency Security Operations Center is now open and operational, and the pilot testing of weapon detection systems is proceeding. The presence of uniformed personnel on the Metro system has increased, and partnered efforts have led to enhanced assistance for individuals experiencing homelessness in securing interim or permanent housing. Further gains in public safety are expected as the agency installs taller faregates at more locations in the system, and the TAP-to-Exit pilot program continues to be rolled out to additional locations. Challenges include the opening of several new stations within a short period, which will require increased security coverage, as well as the presence of individuals experiencing homelessness on real estate adjacent to Metro-owned properties, creating enforcement challenges. An analysis of the condition and utilization of Metro’s real estate, plus evaluation of safety incident response and physical security monitoring, as carry-over projects, are designed to support existing efforts to improve customer safety
• Operational: The agency faces the challenge of hosting several major events in the service area, including the 2026 FIFA World Cup, Super Bowl LXI, and the Summer 2028 Olympic and Paralympic Games. Finding the right balance between ensuring the agency is prepared and positioned to support the success of these events while remaining focused on delivery of core transit services is key. Additionally, with increased staffing needs, streamlining operational processes and improving records management systems are necessary to support these efforts. Ensuring the reliability of the existing bus fleet is maintained through regular maintenance efforts is also essential. Furthermore, accelerating the delivery of customer experience improvements, such as enhanced digital tools for riders, and real-time information at stations is key. As equipment acquisition and facility improvements are underway to help address these challenges, proposed audits on wayside track maintenance and non-revenue vehicle reserve readiness are proposed to evaluate adjacent activities.
• Capital projects: As indicated in the FY26 Annual Program Evaluation, the agency currently has a $33.6 billion capital program encompassing 36 projects. Management identified potential challenges due to the tight skilled labor market for construction which could become even tighter as competition for these resources increases. Specifically, as discussed in the 2025 Metro Construction Market Outlook Special Report, the increased demand for workers in Los Angeles County to support reconstruction efforts from the January 2025 wildfires could result in scarcities. Although most construction trades on Metro projects are skilled/specialized (i.e., tunneling and electrical systems), common trades like carpentry, roofing, plumbing, and heating / ventilation / air condition (HVAC) may still be in high demand. Additionally, as more Metro projects are expected to be delivered using collaborative delivery methods, such as construction manager/general contractor and progressive design-build, this presents both risks and opportunities for the agency.
• Financial: Changes in Federal Transit Administration priorities have the potential to affect the level of federal funding the agency receives. Some stakeholders expressed concern about how shifting trade policy could affect operations and the cost of projects. Also, there was concern about having adequate funding to support the infrastructure augmentation needed to support upcoming major events. Finally, concern was also expressed about the availability of long-term funding to fulfill Metro’s zero-emission bus conversion by 2035.
• Environmental, Social and Governance Risks: There is continued concern about the potential for cyber-attacks against agency systems and the ability to prevent, detect, and respond to cyber incidents using the latest tools, techniques, and methods. The agency continues to explore ways to strengthen its cybersecurity posture.
There are also unique risks that do not clearly fit into one of the outlined major risk categories, as well as risks that may not have been identified or presented during the agency-wide risk assessment. MAS will continue to assess emerging risks throughout FY26 and, if necessary, adjust the Audit Plan.
Audit Plan
The FY26 Audit Plan is based primarily on the results of the agency-wide risk assessment.
Scores were assigned to individual risks in our risk assessment, with consideration given to the potential likelihood and impact of the individual risks. Identified risks are ranked through assessing the potential severity of a risk event and the probability of its occurrence. This assessment helps prioritize risk for audit focus, with high risk scores leading to the selection of projects for inclusion in the FY26 plan. These scores are displayed in Exhibit 1.
Exhibit 1: FY26 Annual Audit Plan project risk scores
Risk scores were not the only guide used by MAS to select audit projects for the FY26 Audit Plan. Additional factors considered included:
• Perceived strength of management controls
• Prior audits or reviews
• Subject matter expertise/capacity required by MAS to perform an audit or review
• Complexity of the risk area
• Input from senior leadership
Accordingly, the Audit Plan includes audit projects to address areas of moderate to high risk that are expected to add value, mitigate potential future risks, and support the achievement of agency goals and objectives.
Outreach was made to the agency’s Senior Leadership Team during the selection of audit projects included in the FY26 Audit Plan to solicit feedback and suggestions about the proposed work. The feedback received was considered and incorporated into the FY26 Proposed Annual Audit Plan (Attachment A).
The FY26 Proposed Annual Audit Plan includes 19 audit projects in three categories: priority, discretionary, and carryover.
• Priority: Audit projects that will be given primary focus during FY26.
• Discretionary: Audit projects that MAS will perform based on the status of priority and carryover projects, and time and resources permitting.
• Carryover: Audit projects initiated in FY25 and will be completed in FY26.
The FY26 Proposed Annual Audit Plan also includes the required Contract and Financial Compliance Audits throughout the year. These audits include contract pre-award and incurred cost audits as requested by Vendor/Contract Management, incurred cost audits of various grant projects, and external financial and compliance audits of Metro and sub-recipients.
Professional audit standards and leading practices suggest that the agency is best served by a dynamic audit plan that can be modified in response to changing business conditions, the discovery of new information, or areas being elevated to priority status based on the needs of the Board of Directors, Chief Executive Officer, and/or senior leadership.
Determination_Of_Safety_Impact
DETERMINATION OF SAFETY IMPACT
Approval of this item will not negatively impact the safety of Metro patrons or employees.
Financial_Impact
FINANCIAL IMPACT
There are no financial impacts associated with the approval of the FY26 Audit Plan.
Equity_Platform
EQUITY PLATFORM
The FY26 agency-wide risk assessment and FY26 Proposed Annual Audit Plan considered Environmental, Social, and Governance risks, which encompass equity, that could affect Metro riders, such as possible delays in project upgrades, or potential conditions that could adversely affect the ridership experience. At least three projects included in the FY26 Proposed Annual Audit Plan were included based in part on these factors. Also, in applying an equity lens to the FY26 AAP, MAS will ask departments during the audits whether any applicable and required Metro equity assessments have been completed.
Vehicle_Miles_Traveled _Outcome
VEHICLE MILES TRAVELED OUTCOME
VMT and VMT per capita in Los Angeles County are lower than national averages, the lowest in the SCAG region, and on the lower end of VMT per capita statewide. These declining VMT trends are due in part to Metro’s significant investment in rail and bus transit.* Metro’s Board-adopted VMT reduction targets align with California’s statewide climate goals, including achieving carbon neutrality by 2045. To ensure continued progress, all Board items are assessed for their potential impact on VMT.
As part of these ongoing efforts, this item is expected to contribute to further reductions in VMT. While this item does not directly encourage taking transit, sharing a ride, or using active transportation, it is a vital part of Metro operations, since it describes areas to be reviewed in FY26 by MAS with the goal of promoting effective and efficient operations and continuous improvement within the organization. Because the Metro Board has adopted an agency-wide VMT Reduction Target, and this item generally supports the overall function of the agency, this item is consistent with the goals of reducing VMT.
**Based on population estimates from the United States Census and VMT estimates from Caltrans’ Highway Performance Monitoring System (HPMS) data between 2001-2019.
Implementation_of_Strategic_Plan_Goals
IMPLEMENTATION OF STRATEGIC PLAN GOALS
Approval of this item supports Metro Vision 2028 Goal #5: Provide responsive, accountable, and trustworthy governance within the Metro organization. The projects included in the Audit Plan directly or indirectly support various goals outlined in Metro’s Vision 2028 Strategic Plan and the CEO's 2023 strategic aspiration placemat.
Alternatives_Considered
ALTERNATIVES CONSIDERED
An alternative is not to approve the FY26 Proposed Annual Audit Plan. This is not recommended, as it is a management tool for systematically assigning resources to deliver an agency-wide audit plan in accordance with the Financial Stability Policy. Additionally, developing an annual internal audit plan is consistent with the MAS Audit Charter and Generally Accepted Government Auditing Standards.
Next_Steps
NEXT STEPS
Upon Board approval, MAS will develop the FY26 Annual Audit Plan schedule and deliver quarterly status reports to the Board of Directors.
Attachment
ATTACHMENT
Attachment A - FY26 Proposed Annual Audit Plan
Prepared_by
Prepared by: Kimberly L. Houston, Deputy Chief Auditor, (213) 922-4720
Alfred Rodas, Senior Director, Audit, (213) 922-4553
Reviewed_by
Reviewed by: Sharon Gookin, Deputy Chief Executive Officer, (213) 418-3101
