HomeMy WebLinkAboutAgenda CC 11.24.2020 WorkshopN otice of M eeting of the
Governing B ody of the
C ity of Georgetown, Texas
N ovember 24 , 20 20
The Georgetown City Council will meet on November 24, 2020 at 3:00 P M at Teleconference
The City of Georgetown is committed to compliance with the Americans with Disabilities Act (AD A).
If you require assistance in participating at a public meeting due to a disability, as defined under the
AD A, reasonable assistance, adaptations, or accommodations will be provided upon request. P lease
contact the City Secretary's Office, at least three (3) days prior to the scheduled meeting date, at (512)
930-3652 or City Hall at 808 Martin Luther King J r. Street, Georgetown, TX 78626 for additional
information; TTY users route through Relay Texas at 711.
J oin fr om a P C, M ac , i P ad, i P hone or A ndroid devic e ple ase clic k this
U R L : https://ge orge towntx.zoom.us/j/98984149740?
pwd=M 3 R ZS E 5 Y V3 UwO U d3 M 3pvN D N0 O F d0 Q T09
Webinar I D: 989 8414 9740
P assc ode : 915990
De sc ription: Re gularly S cheduled Wor kshop and R egular M ee ting of the
Geor getown City C ouncil - Novembe r 24, 2020
Workshop starts at 3:00 p.m. but attende es can join the we binar star ting at
2:30 p.m.
O r to join by phone dial:
(346)248-7799 O R (253)215-8782 O R (669)900-6833 O R (301)715-8592
O R (312)626-6799 O R (929)205-6099
TO L L F R E E (833)548-0276 O R (833)548-0282 O R (877)853-5257 O R
(888)475-4499
Webinar I D: 989 8414 9740
P assc ode : 915990
Citizen comme nts are acc epted in thr ee differ ent for mats:
Submit the following form by 12:00 p.m. on the date of the mee ting and the
City S ec re tary will r ead your comme nts into the re cor ding dur ing the ite m
that is be ing disc usse d –
Page 1 of 173
https://re cor ds.geor getown.or g/F or ms/Addr essCounc il
You may log onto the me eting, at the link above , and “raise your hand”
dur ing the ite m. If you ar e unsur e if your devic e has a mic rophone ple ase
use your home or mobile phone to dial the toll fr ee number. To J oin a
Zoom M ee ting, clic k on the link and join as an attende e. You will be asked
to e nte r your name and email addre ss – this is so we can identify you whe n
you are calle d upon. At the bottom of the we bpage of the Zoom M e eting,
ther e is an option to Raise your H and. To speak on an ite m, simply clic k on
that R aise Your H and option onc e the item you wish to spe ak on has
opened. Whe n you are calle d upon by the M ayor, your de vice will be
r emotely un-muted by the A dministrator and you may speak for thr ee
minute s. P lease state your name clear ly upon be ing allowe d to spe ak.
When your time is over, your de vice will be muted again.
As another option, we ar e opening a city confe re nc e r oom to allow public
to “watch” the virtual mee ting on a bigge r scr ee n, and to “r aise your
hand” to speak fr om that public de vice . This Vie wing Room is loc ated at
City H all, 808 M artin L uther K ing J r. S tre et, Community R oom. Soc ial
Distancing will be strictly enfor ce d. F ac e masks ar e r equire d and will be
provided onsite . U se of profanity, thre atening language , slander ous
r emarks or thr eats of harm are not allowed and will re sult in you be ing
immediate ly r emove d from the me eting.
If you have questions or ne ed assistanc e, ple ase contact the City
Se cr etar y’s offic e at c s@ge orge town.org or at 512-930-3651.
Policy De ve lopme nt/Re vie w Workshop -
A P resentation and update regarding mitigation efforts related to the 2018 Risk Assessment --
Mayra Cantu, Management Analyst
B Overview and discussion regarding the purpose of P ublic Improvement Districts (P ID) and the
City’s P ID P olicy -- Wayne Reed, Assistant City Manager
C P resentation and discussion regarding the creation of a P ublic Improvement District (P ID) called
P arks at Westhaven -- Wayne Reed, Assistant City Manager
D Review and discussion regarding 2021 boards and commission appointments -- Robyn Densmore,
City Secretary; and David Morgan, City Manager
Exe cutive Se ssion
In compliance with the Open Meetings Act, Chapter 551, Government Code, Vernon's Texas Codes,
Annotated, the items listed below will be discussed in closed session and are subject to action in the
regular session.
E Sec. 551.071: Consul tati on w i th Attorney
Page 2 of 173
Advice from attorney about pending or contemplated litigation and other matters on which the
attorney has a duty to advise the City Council, including agenda items
- Litigation Update
Sec. 551.072: Del i berati ons about Real P roperty
- S H-29 Right of Way, Hillwood -- Travis Baird, Real Estate Services Manager
Sec. 551.086: Certai n P ubl i c P ow er Uti l i ti es: Competi ti ve M atters
- Competitive Matters -- Daniel Bethapudi, General Manager of the Electric Utility
Sec. 551.074: P ersonnel Matters
-City Attorney Check-in
Adjournme nt
Ce rtificate of Posting
I, R obyn Densmore, C ity S ecretary for the C ity of G eorgetown, Texas, do hereby c ertify that
this Notice of Meeting was pos ted at C ity Hall, 808 Martin Luther King Jr. S treet,
G eorgetown, T X 78626, a plac e readily ac cessible to the general public as required by law, on
the _____ day of _________________, 2020, at __________, and remained so pos ted for
at leas t 72 c ontinuous hours prec eding the s cheduled time of said meeting.
__________________________________
R obyn Dens more, C ity S ec retary
Page 3 of 173
City of Georgetown, Texas
City Council Workshop
N ovember 24, 2020
S UBJEC T:
P resentation and update regarding mitigation efforts related to the 2018 Risk Assessment -- Mayra Cantu, Management
Analyst
I T EM S UMMARY:
In 2018 the City had a citywide risk assessment c onducte d by P lante Moran. The study identified risks across the City
and made recommendations to help address and mitigate tho se risks. This update details the mitigation efforts that have
been made and the current state of those risks.
The Risk M itigation Repo rt provides a detailed update to the 2 01 8 risk assessment. A full review of each risk can be
found in the appendix where the risk register outlines the completed actions and current mitigation status.
F I NANC I AL I MPAC T:
N A
S UBMI T T ED BY:
Mayra Cantu, Management Analyst
AT TAC HMENT S :
Description
R isk Mitigation R eport
R isk Mitigation P resentation
Weaver Assessment
2018 R is k Assessment
Page 4 of 173
Risk Mitigation Report
UPDATE TO 2018 CITYWIDE RISK ASSESSMENT
CITY OF GEORGETOWN 2020
Page 5 of 173
RISK MITIGATION REPORT 1 | Page CITY OF GEORGETOWN
Table of Contents
Purpose and Introduction ........................................................................................................................ 2
Risk Assessment and Mitigation Cycle .................................................................................................... 2
Risk Management Methods ................................................................................................................. 3
Notable Changes ...................................................................................................................................... 4
Departments ............................................................................................................................................. 4
2018 Citywide Risk Assessment ............................................................................................................... 5
Mitigation and Next Steps ....................................................................................................................... 8
City Manager’s Office ................................................................................................................................ 8
Facilities .................................................................................................................................................... 8
Emergency Management .......................................................................................................................... 9
Public Safety .............................................................................................................................................. 9
Finance and Human Resources ............................................................................................................... 11
City Secretary .......................................................................................................................................... 13
Information Technology .......................................................................................................................... 13
Overall Utility System .............................................................................................................................. 14
Electric ..................................................................................................................................................... 15
Water and Wastewater System .............................................................................................................. 17
Public Works ........................................................................................................................................... 19
Near Term Action ....................................................................................................................................... 20
APPENDIX .................................................................................................................................................... 21
Risk Mitigation Register .......................................................................................................................... 21
Page 6 of 173
RISK MITIGATION REPORT 2 | Page CITY OF GEORGETOWN
Purpose and Introduction
In 2018 a citywide risk assessment was conducted by Plante Moran, which outlined several risks
across departments. Plante Moran also included risk treatment action plans for the risks they
identified with recommendations on ways to mitigate in the future to reduce the risk likelihood
or impact. This report outlines the mitigation and risk treatment statuses of the identified risks
from 2018.
Risk Assessment and Mitigation Cycle
Steps 1-3 of the risk cycle were completed at different stages since 2018. After the risk assessment was
conducted, the City has been in the 3rd part of the cycle with risk owners treating their risk with varying
degrees of mitigation. The City now concurrently enters the last step of the cycle, step 4, as each risk is
reviewed, and mitigation efforts are tracked to reassess whether the risk score has decreased. After this
is completed the City will need to have another citywide ERP risk assessment conducted by 2023 to
successfully identify new risks across the city from an enterprise and operational standpoint.
Overall, most risks identified in 2018 have been mitigated or the risk has been accepted and steps are
being taken to fully mitigate in the future as detailed later in this report.
1. Risk
Identification
2. RIsk
Assessment
3. Risk
Mitigation,
Planning, and
Implementation
4. Risk and
Mitigation
Tracking
Page 7 of 173
RISK MITIGATION REPORT 3 | Page CITY OF GEORGETOWN
Risk Management Methods
Risk does not always have to be mitigated. Several risk management methods exist that can be used
instead to either eliminate a risk with risk avoidance, transferred to a third party with risk transfer, or even
accepted because the risk is negligible that it would cost more to manage it then what it could possibly
impact.
Risk Mitigation
Risk mitigation is a risk management technique by which an organization introduces specific measures to
minimize or eliminate unacceptable risks associated with its operations. Risk mitigation measures can be
directed towards reducing the severity of risk consequences, reducing the probability of the risk
materializing, or reducing the organizations exposure to the risk.
Risk Avoidance
Risk avoidance is a technique of risk management where the goal is to eliminate a risk and not just reduce
it. Rather than mitigating existing risk, it aims to eliminate the source of the risk altogether, sometimes
replacing it with a smaller, more easily manageable risk.
Risk Transfer
Risk transfer is a risk management technique in which risk is transferred to a third party. In other words,
risk transfer involves a party assuming the liabilities of another party. Purchasing insurance is a common
example of transferring risk from an individual or entity to an insurance company.
Risk Acceptance
Risk acceptance is the assumption of a risk, typically because its risk-reward profile is attractive and within
your risk tolerance. In general, it is impossible to make gains in business or life without taking risks. As
such, risk acceptance is a common risk treatment.
Mitigation Avoidance
Transfer Acceptance
Page 8 of 173
RISK MITIGATION REPORT 4 | Page CITY OF GEORGETOWN
Notable Changes
Significant events and operational changes since the 2018 citywide risk assessment update–include the
following:
• 3rd party electric energy portfolio manager
• City department reorganization
• Workday ERP
• COVID-19; impact on FY2020 budget and beyond
• Police and Fire agree and confer
• Finance bond rating
• In the spring of 2019, the Fire Department filed a “breach notification” report regarding an
unencrypted EMS tablet that went missing from one of the ambulances. This breach had the
potential to impact up to 719 patients.
The 2018 Risk Assessment identified the most prevalent risks lived within the following departments.
Departments
• City Secretary’s Office
• City Manager’s Office
• Controller
• Emergency Management
• Finance
• Fire
• Human Resources
• Information Technology
• Facilities
• Police
• Purchasing
• Records
• Utility
Page 9 of 173
RISK MITIGATION REPORT 5 | Page CITY OF GEORGETOWN
2018 Citywide Risk Assessment
The risk assessment conducted in 2018 established the following risk universe for the City of
Georgetown.
City of Georgetown Risk Universe
1. Access to Talent 18. IT Security Awareness, Training, and
Education
2. Billing for Citizen Services 19. IT Third Party Roles and Responsibilities
3. Budget and Planning 20. Leadership
4. Composition of Tax Base 21. Legislation
5. Disaster Recovery/Business Continuity 22. Physical Security
6. Emergency Notification System Failure 23. Police failure
7. Fire Department Failure 24. Records Management
8. Freedom of Information Act (FOIA) 25. Regulatory Filings
9. Fraud 26. Segregation of Duties
10. Grant Obligations 27. State-Fed Regulations
11. Health & Safety 28. Succession Planning
12. IT Access Management 29. Talent Management
13. IT Asset Management: Data Classification 30. Tax
14. IT contingency Plan 31. Utility market
15. IT Critical Security Event Identification 32. Utility Outage
16. IT Cybersecurity Governance Model 33. Vendor Reliance
17. IT Incident Response Management
Each department has at least one of the above risks identified. Plante Moran worked with the
departments to identify management responses to mitigate those risks at the time and outlined next steps
to further mitigate the risks. The risks were given a risk impact score which was calculated utilizing ranked
criteria: impact (financial, strategic, operational or compliance) and likelihood (probability or event
occurrence) as noted below.
Impact Criteria
Ranking 5 (high) 4 3 2 1 (low)
Financial Impact:
Expense or Lost Revenue >$150K $100K-150K $50K-$100K $25K-$50K <$25K
or Strategic Impact:
Strategy/Mission/Legislature Failure to
meet key
strategic
objective
Major
impact on
strategic
objective
Moderate
impact on
strategy
Minor
impact on
strategy
No impact
on strategy
or Operational Impact:
Reputation Extreme Severe Moderate Low None
Process/System Shutdown >7 days 5-7 days 3-5 days 1-3 days <1 day
Compliance Impact:
Regulatory-
State/Local/HIPAA/Debt
Covenants
Large-scale
material
Material
breach but
Material
breach
which can
Minimal
breach
which
Minimal
breach
which can
Page 10 of 173
RISK MITIGATION REPORT 6 | Page CITY OF GEORGETOWN
breach of
regulation
cannot be
rectified
be readily
rectified
cannot be
rectified
be readily
rectified
Likelihood Criteria
Ranking 5 (high) 4 3 2 1 (low)
Probability of an event occurring in a given year:
>20% 15-20% 10-15% 5-10% <5%
or Event Occurrence (on average):
Once a year
or more
1 in 3 years 1 in 5 years 1 in 7 years 1 in 10
years
2018 Residual Risks by KBD:
Weighted Risks by Key Business Departments: the total number of risks weighted by rankings using
the following weighting formula: Red 17 or > (3 points), Yellow 8-16 (2 points), and Green <8 to 5 (1
point), <4 (0 points). Therefore, the higher risk rankings carry a higher weighted risk.
Since then these risks have been primarily mitigated, and a detail can be found in the appendix.
Page 11 of 173
RISK MITIGATION REPORT 7 | Page CITY OF GEORGETOWN
The 2018 risk assessment highlighted several high-level themes, particularly focused in Information
Technology, Georgetown Utility Services, legislation, and policies and procedures. Since 2018, several
strides have been made in each of these high-level themes.
High-Level Themed Risks Risk Treatment Responses and Mitigation
• The City is exposed to four high Information
Technology (IT) residual risks. We recognize the City is
currently in process of an ERP system upgrade and the
status of these conditions will change in the near
future: IT Cybersecurity, IT Asset Management: Data
Classification, IT Access Management, and IT
Contingency Plan. See Appendix B for IT Risk Report.
•IT is working on a comprehensive policy covering IT
Cybersecurity, IT Asset Management: Data
Classification, IT Access Management, and IT
Contingency Plan.
• The City lacks a clear process for the assignment and
review of user access roles and responsibilities to
achieve segregation of duties in three key business
departments. We noted during discussions with
Finance, Customer Care and Parks and Recreation one
person can control more than two phases of a
transaction exposing the City to unauthorized
transactions and fraud risk.
• Workday has mitigated this risk, with various level of
approvals needed for transactions. The requisitioner
must have each requisition reviewed and approved by
at least two people, with one being the manager. The
risk of fraud has been mitigated significantly, if not
almost entirely with the new ERP system and its
integrated steps for accountability.
• Management indicated several potential costly
Texas legislative acts are due for review at future
legislative sessions.
• Staff has created an Intergovernmental Affairs
Program which will prioritize the City’s legislative
agenda considering public input; a committee is being
created to enact this program. Focused Advocacy has
also been hired as a consultant to aid in representing
the City in legislative session. The City of Georgetown
is also a participating TML city, allowing TML to
provide guidance, direction, and advocacy on behalf
of City’s best interests.
• The City is challenged with documentation of
operating policies and procedures. Currently, 15 out
of 25 (60%) departments we interviewed have a lack
of clearly written policies and procedures available to
all employees
• Since 2018 many of the lacking policies have now
been written, with even more reviewed. Staff has
identified a need to centralize a location for its policies
and create a process or committee to review policies
regularly to ensure they are up to date and follow legal
mandates.
Page 12 of 173
RISK MITIGATION REPORT 8 | Page CITY OF GEORGETOWN
Mitigation and Next Steps
The departments identified in the 2018 risk assessment have taken several mitigating steps which are fully
detailed in the risk register found in the appendix. The section below provides a deeper dive into the more
significant risks and the corresponding mitigation actions that have been completed or ongoing.
City Manager’s Office
Performance Management Review
The City Manager’s Office routinely reviews departments performance metrics. On a biannual basis the
metrics are reviewed and analyzed for performance and to assess whether the metrics are measuring
what needs to be measured. These metrics are utilized in a variety of ways by departments and city
management such as providing data to substantiate budget requests or to identify how well things are
going in each area or to identify areas of concern that are not performing as well.
Business Plans
The City had all departments and service areas create and complete business plans. These business plans
help strategically align the departments missions and goals to objectives that will be completed over the
next few years. The business plans had the departments identify their key performance indicators that tie
their strategic goals with City Council Goals. Council goals were also used to tie in and from an action plan
created to enhance the department’s ability to meet organizational, customer, and workforce
requirements. The business plans are utilized by staff as they move forward in completing their action
plan.
Legislative Task Force
The Legislative Task Force is a special ad hoc group comprised of active leaders in the community - the
leadership of City Boards and Commissions. With the membership comprised of the Boards and
Commissions leadership, the Legislative Task Force are knowledgeable members of the community,
educated on City priorities, and representing a wide range of City interests. The Legislative Task Force will
provide input to City Council on the issues relevant to the State Legislative Agenda in preparation for the
Texas State Legislative Sessions.
Facilities
Facility Access Policy
As City Facilities move to a public lobby and secure back of house model, access control becomes more
important. This policy will help establish necessary employee access to non-public areas within City
Facilities.
Georgetown Municipal Complex Remodel
Secure separation of public and employee space requires building modifications, including access
control doors and publicly accessible meeting space to keep employees from bringing public into the
secure space. The GMC remodel creates that separation and adds meeting space in the public area.
Light and Waterworks Remodel
Page 13 of 173
RISK MITIGATION REPORT 9 | Page CITY OF GEORGETOWN
Light and Waterworks building currently requires entry from an alley and there is no separation from the
public space and employee areas. The LWW Remodel moves the front Planning entry to Martin Luther
King Jr. St. This entry fits better within the City Center and allows the use of a public lobby with a secure
door to the employee area.
Emergency Management
COVID-19 Response
The City declared a local disaster and activated a virtual emergency operation center in response to
COVID-19. In addition, the City is working closely with Williamson County, the Williamson County and
Cities Health District, and State partners to coordinate our response to the pandemic.
In July, the Mayor issued an order requiring the wearing of face coverings while in businesses with some
exceptions. These orders were later amended to reflect statewide mask order issued by the Governor.
The Governor’s orders also prohibit outdoor gatherings of more than 10 people at a time, without mayoral
approval.
Additionally, the City is seeking reimbursement through Williamson County for COVID-19 related expense
that are eligible to be covered by the CARES act. These funds are being dispersed in three tranches to
cover expenses through calendar year 2020. The City has also created an inventory of personal protective
equipment to ensure adequate supplies both for first responders and general employees to be
appropriately protected.
Finally, the City has amended internal personnel policies to ensure appropriate social distancing at work,
allowing employees to telework when appropriate, and appropriate measures are taken when employees
test positive for COVID-19, including administering federal ESICK and EFMLA programs.
Hazard Mitigation Action Plan
The City is in the process of updating its Hazard Mitigation Action Plan. The plan helps the City
appropriately assess, prioritize, prepare for, and mitigate natural or human-caused hazards. This plan will
allow the City to maintain eligibility for future federal mitigation grant funding and help identify mitigation
actions that will make the local community more disaster resistant. The planning efforts are expected to
begin in October and be completed in the first quarter of 2021. The plan will require state and federal
review prior to City Council adoption.
Public Safety
HIPAA Audit
In the spring of 2019, the Fire Department filed a “breach notification” report regarding an unencrypted
EMS tablet that went missing from one of the ambulances. This breach had the potential to impact up to
719 individuals and the City began a review of procedures and practices. This review has been expanded
to include a HIPAA audit in September 2020 to adequately address any gaps in procedures and policy. The
audit will identify measures that need to be taken to maximize the protection of private health
information as defined within the Health and Human Services’ Security Rule 45 CFR Part 160 and Subparts
A and C of Part 164. The HIPAA Security Rule establishes national standards to protect individuals’
electronic personal health information that is created, received, used, or maintained by a covered entity.
The Security Rule requires appropriate administrative, physical, and technical safeguards to ensure the
confidentiality, integrity, and security of electronic protected health information. This audit will help
Page 14 of 173
RISK MITIGATION REPORT 10 | Page CITY OF GEORGETOWN
inform changes that need to be made to reduce the risk of a breach occurring again and is expected to be
completed by December 2020.
Also, to further reduce risk, the City is in the process of creating a HIPAA hybrid entity which would create
a healthcare component and discern what areas would be subject to HIPAA privacy regulations. This would
ensure that only the designated areas that need to comply with HIPAA privacy rules would do so, instead
of the entire organization. Only these newly identified areas would have the right to use, maintain, access
and/or transmit personal history information. This process will create clear boundaries to further protect
sensitive information and create internal controls to limit access.
Guardian Tracking: Performance Management Software
Since 2012, the police department has been utilizing Guardian Tracking, a performance management
software platform. The software is used to formally capture praise, counseling, goal setting, and discipline.
The software also serves as an early warning system for repeated substandard performance.
Replacement of Police Body Cameras
In 2019, due to reliability issues with the previous vendor, non-compatibility between car and body
cameras, and the inability to keep existing equipment serviceable we replaced all car cameras, body
cameras, and facility interview cameras. We transitioned to WatchGuard, a Texas based company and
industry leader with regards to police vehicle cameras, body cameras, and digital evidence management
software. Now all cameras and the digital data derived are on one unified management software system.
The current technology is far superior to the old allowing for real time viewing, wider angles, seamless
integration between car and body cameras, and automatic synchronization of all incident cameras on
playback.
CommUNITY Advisory Task Force
The police department established a Chief’s CommUNITY Advisory Task Force in July of 2020 comprised
of 20+ diverse community leaders. The task force will be working with the Chief to provide input regarding
the state of policing in Georgetown as well as providing input as to the direction of the CommUNITY
Initiative. The police department plans to conduct six Listen and Learn Summits across six different
stakeholder groups in FY2021.
Police Training - Arbinger institute
The police department is in the process of having their officers complete training created by the Arbinger
Institute. This training focuses on transitioning a self-focused inward mindset to an impact-focused
outward mindset. Arbinger’s Policing with an Outward Mindset™ program addresses three key challenges
in law enforcement today:
Situational Awareness and Officer Safety
o Officers must increasingly operate in ways that are both smart and safe. This requires the
self-awareness and motivation to be the most trained, skilled, and conditioned version of
themselves possible. In addition, officers must be aware of contextual behavioral
anomalies indicative of dangerous or criminal behavior without being distracted by
factors such as race, gender, age, sexual orientation, etc.
Trust and Collaboration
Page 15 of 173
RISK MITIGATION REPORT 11 | Page CITY OF GEORGETOWN
o With so many factors influencing incident narratives and investigations, trust, and
collaboration within agencies and with the communities they serve has become critical—
but also quite difficult.
Leadership
o Law enforcement leaders today must carry a deep sense of personal responsibility to
develop competency in each of their roles and to understand the impact they have on
others while carrying out their duties. Such a leader inspires and systematically develops
similar personal responsibility from others.
Arbinger enables organizations and their people to turn outward through a three-step process: mindset
change, leader development, and systems improvement.
Fire station 6 and 7
Fire Station 6 is open and 7 is set to open soon, adding additional resources to key areas within the City
for a more efficient response. In having these stations come online the Fire department will also have
more staff to reduce the number of overtime hours.
Finance and Human Resources
Workday
The City has converted to a new ERP system, Workday. This new system has aligned financials and human
resources to one system streamlining purchasing, travel, recruiting, on-boarding, performance, benefits,
payroll, accounting, and budget to name a few high-level processes. This conversion has fully mitigated
many threats outlined in the 2018 assessment with more restricted security roles limiting access to
sensitive information. The system also requires 2-factor authentication furthering our security of the
system. Workday is cloud based, allowing for business continuity in the case of a disaster impacting our
critical network and infrastructure. Overall, conversion to Workday has allowed for more efficient
processes and reporting options for staff.
The workday implementation has addressed the following:
Page 16 of 173
RISK MITIGATION REPORT 12 | Page CITY OF GEORGETOWN
• Conducted detailed process reviews to implement best practices
• Enhanced user and access controls
• Requires 2 Factor Authorization to access
• Created process controls such as budget checks on purchases and created a system of multi- level
of approvals for purchases
• Implementing the budget module Adaptive to streamline and integrate workflows within the
Workday system
Internal Audit Plan
Staff is creating a multi-year internal audit to apply a disciplined approach to evaluate and improve the
effectiveness of risk management, control, and governance processes. The internal audit plan reinforces
the City’s commitment to accountability and integrity while having an objective party look for ways to
improve operations. Some of the audits staff are including in the audit plan are:
• Fee Collection Review
• Hotel/Motel Audit
• Franchise Fees
• Airport Revenue
Sales Tax Audit
The State is currently conducting a sales tax audit that began in June 2020. The audit is done to ensure
that Texas tax laws are applied uniformly and to promote compliance. The audit helps determine whether
taxes have been properly collected, reported, and paid to the state.
Policy Updates
Six personnel policies were updated in alignment with Workday implementation in 2019 including
introductory period, vacations, sick leave, hours of work, compensatory time, and holiday. Multiple
temporary policies have been issued during the COVID-19 Pandemic including telework and flex time.
Safety & Risk Management Team
The City’s safety and risk management programs were combined, centralized, and staffed by three full-
time employees focused on the development and evaluation of occupational safety and risk management
programs in 2019.
Since that time, the team has improved handling of citizen claims, improved accuracy in covered city
property, improved management of our third-party risk pool administrators, and given greater support to
our employees who experience work-related injuries.
The team has deployed the first phase of active shooter and building evacuation training, with more to
come. They are also building data sets to better understand worker injury and accident trends and
working with stakeholders on appropriate mitigating actions.
Organizational Development
Page 17 of 173
RISK MITIGATION REPORT 13 | Page CITY OF GEORGETOWN
The City hired its first learning and development coordinator in 2020. The coordinator has built a learning
and development strategic plan that will be deployed over the next two years. Included in that plan is our
multiyear approach to talent management and making use of Workday talent capabilities.
In 2019 the City created the organizational & operational excellence office, focused on helping staff ‘eat
elephants…one bite at a time.’ The office works to empower staff at all levels through our organizational
performance management (see City Manager section) and process improvement programs. The office
has since rolled out annual business plans for all departments, lean trainings to over 1,000 participants,
and currently support over 60 lean process improvement projects.
City Secretary
Freedom of Information Act – Compliance with Open Records
The Open Records Coordinator will continue to provide annual trainings to staff related to best practices
for responding to FOIA requests and do routine reviews of the Open Records Request policies and
procedures. The City Secretary’s Office will continue to work towards adding another Open Records
Coordinator to mitigate the large workload that the growing number of open records requests provide.
Records Management – Current Practice
The Records Management team does routine departmental check-ins and works to organize projects that
make departments more efficient and less reliant on paper. The Records Management Team does a
routine review of the Records Management policies and procedures to ensure that best practices are
always being implemented. They also provide annual training to all employees.
Agenda Process
Staff members from City Secretary’s Office, City Attorney’s Office, City Manager’s Office, and Purchasing
are working together to improve the agenda process that is currently not as efficient as it could be. City
Secretary Office is also looking into the possibility of switching agenda software.
Information Technology
Cybersecurity Policy
The IT Department has completed a primary draft of a comprehensive Cybersecurity Policy. The draft has
been reviewed by first line technical staff and is being prepared for final round of review by the Human
Resources, City Secretary, and Legal Departments.
Staff participated in a cybersecurity tabletop exercise in October 2020 conducted by the Texas
Department of Information Resources. The tabletop discussion covered the potential impacts of a
computer security incident impacting a local community. This training furthered staff’s education on
responding to a cybersecurity incident and its potential impacts.
System and Network Contingency Plan
The IT Department currently has an Incident Response Plan in development through the Human Resources
Departments Lean Process Development methodology. This plan is scheduled for completion in
December of 2020.
Security Information and Event Management System
Page 18 of 173
RISK MITIGATION REPORT 14 | Page CITY OF GEORGETOWN
Multiple Security Information and Event Management Systems (SIEMs) are under review by the IT
Department. Also, the IT Department is evaluating the possibility of managed service contracts through
the Texas Department of Information Resources to help fulfill this need. Due to budgetary constraints
presented by COVID-19, a purchase was not proposed for FY 2021. Pending budget availability for FY
2022, IT will work toward the purchase and implementation of a SIEM system.
Staff IT Security and Awareness Training
The City of Georgetown successfully implemented a Security and Awareness Training initiative in FY 2020.
This included training and testing for all City IT users through the City’s Learning Management System. In
June of 2020, the City Security Awareness Training program was certified by the State of Texas as complete
for the current calendar year.
Back-Up Data Center
A back-up data center was successfully brought online in the Winter of FY 2020. The purpose of this data
center is to act as a failover in the case of a failure at the City’s primary data center. Failures could include
physical destruction or damage to the primary datacenter by a man-made or natural disaster. Failures
may also include some types of cyberattacks. In such a case, the back-up data center could be brought
online and subsequently run 90 percent of the City’s technology systems within a matter of hours. This
includes all the City’s mission critical data systems.
Overall Utility System
Weaver Assessment – Cash Receipt Review
The City of Georgetown engaged with Weaver and Tidwell, LLP to provide assist in the review and
identification of all cash receipts currently received the by City’s Utility Billing Office and identify
alternative locations and processes for non-utility payments. Weaver and Tidwell also provided risk-
control matrices and process mapping for areas in the City’s Utility and Accounting Offices where internal
risks could occur.
Weaver Assessment – UMAX Business Process Mapping
The Weaver and Tidwell, LLP engagement also provided a review of the City’s Utility Office internal
controls, transactional processing efficiencies and review of audit trails and automated workflows
integrated in the City’s new UMAX/CIS. Four (4) high-risk, fifteen (15) moderate risk, and four (4) low-
risk processes were identified. These ranking provided guidance to the City with regards to prioritizing
effort and resources. It also documented workflows that are used when reviewing business processes.
The high-risk areas have been mitigated and many of the moderate risks have been addressed.
Gartner Assessment – AMI/CIS and MDM Systems
The City of Georgetown engaged with Gartner Consulting to conduct an assessment an analysis of the
City’s Customer Information System (CIS), Advanced Metering Infrastructure (AMI) and Meter Data
Management (MDM) systems. The objective is to evaluate the City’s CIS business processes against the
current CIS system, identify gaps or areas for opportunities, and explore alternative options to improve
the City’s CIS operations and supporting technologies. As well as to evaluate the business value provided
by the AMI and MDM systems to enable the City to meet its smart meter information needs.
Page 19 of 173
RISK MITIGATION REPORT 15 | Page CITY OF GEORGETOWN
Electric
The electric utility went through a management assessment conducted by Schneider Engineering., The
following were the recommendations from the management assessment:
1. Develop and implement comprehensive risk management policy.
a. Leverage internal and external resources to increase oversight and accountability for
decision making regarding contracts management.
b. Procure third party energy management services.
2. Study the installation of separate governance structure for Georgetown Utility Systems.
Based on the recommendations, the following action were taken to better manage the risks.
Adoption of comprehensive Energy Risk Management Program:
The new Energy Risk Management Policy governs all purchase power and related activities that may
impact the Energy Risk profile of Georgetown Electric Utility. Activities that fall within the scope of this
Policy include, but are not limited to, the following:
• Wholesale Transactions (PPA, Bilateral Trades)
• Independent System Operator (ISO)/ERCOT Market Transactions (DAM/RTM/AS)
• Energy hedging activities involving physical and financial energy products
• Basis hedging activities involving energy products
• All energy commodity trading
• Counterparty contracting and credit management
Under the new Energy Risk Management Policy there are multiple levels of oversight provided to the
electric fund.
Overall policy oversight is provided by City Council and the Georgetown Electric Board (GTEB).
Independent 3rd Party provides Risk Management Compliance reporting to GTEB and City Council.
Page 20 of 173
RISK MITIGATION REPORT 16 | Page CITY OF GEORGETOWN
Risk Oversight Committee
The Risk Oversight Committee (ROC) is an internal committee that oversees approval and compliance of
transactions and risk limits. The committee is comprised of the City’s executive team (City Manager and
Assistant City Managers), the Electric General Manager and staff, and the Finance Director. ROC provides
inputs to the risk management strategy and receives weekly/monthly risk management updates from the
Risk Management Committee.
Risk Management Committee
The Risk management Committee (RMC) is comprised of Shell, the Electric General Manager, and staff, as
well as independent consultants. The RMC implement the risk management strategy approved by the
ROC. The RMC reviews existing and potential transactions, monitor proximity to limits, and helps support
the responsibilities of the ROC. Ultimately the RMC, is responsible for the day-to-day execution and
management of transactions.
Page 21 of 173
RISK MITIGATION REPORT 17 | Page CITY OF GEORGETOWN
Procurement of 3rd Party Electric Energy Portfolio Management Services:
In December of 2019 Council approved an agreement with Shell Energy North America to provide energy
management services. Shell will be developing and making recommendations regarding how
Georgetown’s energy is traded in the Texas energy market. Shell will also assist in forecasting energy
needs, energy costs, and addressing challenges related to transmitting energy around the state, all of
which affect the city’s costs associated with purchasing power.
In addition to Shell North America, Crescent Power and ACES Power Marketing aid the staff in managing
the overall energy portfolio risk and risk management policy compliance.
Creation of new Electric Board to provide better risk and financial oversight:
Starting June 2020, a new electric oversight board was set up. The electric board’s proposed role in risk
management is as follows:
• Aid the City Council in providing the overall Policy Oversight.
• An independent third party appointed by the Georgetown Electric Board will provide periodic Risk
Management Policy Compliance reports to the GTEB and City Council.
• Receives Monthly Risk Management Policy updates from Risk Oversight Committee (ROC) and
Risk Management Committee (RMC)
Line Extension and Meter Connect Revenue Risk Mitigation
To ensure all revenue is properly collected, review of the revenue generating activities related to electric
infrastructure additions and service provisioning identified revenue loss and revenue leakage.
The causes for lost revenue and revenue leakage were:
1. Unsent/unpaid/overdue invoices for electric infrastructure additions.
2. Sub-optimal business processes and significant short comings of the software systems led to
significant under-collection of electric meter connect fees.
Mitigation activities:
1. Business re-organization led to the electric engineering and project management function under
the electric cost center. This identified the revenue losses and the redesigned processes led to
better control and management of the electric infrastructure additions with appropriate cost
recovery.
2. New Electric line extension policy implemented in early part of FY 2020, clearly identifies the
infrastructure addition costs and the requirement of pre-payment of the invoices mitigated the
risks posed by unpaid/overdue invoices.
3. Short term mitigation strategies were identified which address the meter connect revenue loss.
The long-term mitigation strategy of a comprehensive business process redesign of the utility
service connection is in progress. The new process will be in place starting January 1st, 2021.
Water and Wastewater System
Risk Assessment of Water Utility
Page 22 of 173
RISK MITIGATION REPORT 18 | Page CITY OF GEORGETOWN
The water utility had a risk and resilience assessment conducted by CDM Smith to comply with a new
mandate set by the American Water Infrastructure Act. The assessment outlined several
recommendations to help mitigate risks and improve system resiliency against the highest risk threats
identified. The recommendations for the water utility system are:
Plan for use of portable power supply generators during an emergency to supply temporary power to
critical system components that do not currently have back-up generators or hook-ups.
Expand Lake water treatment plant and build a new water treatment plant south of the lake to
improve system redundancy during an emergency (this is in the planning process with expansions and
new treatment plant construction tentatively scheduled within the next five to seven years).
Implement floodproofing techniques at the Park water treatment plant to protect critical system
components from damages during flood or dam failure.
Develop a source water protection plan for Lake Georgetown and Lake Stillhouse Hollow in
coordination with the Brazos River Authority, United States Army Corps of Engineers, and other
stakeholders.
Improve physical security measures at critical facilities to reduce the risk of an outsider threat
accessing critical assets. Examples may include automatic lock doors at water treatment plants, or
motion sensors that trigger security camera alerts outside of regular business hours when personnel
are not physically on-site.
Many of these recommendations are being addressed in the years to come with the City’s capital
improvement plan to expand water treatment capability as well as an initiative with the Brazos River
Authority (BRA) to secure additional water resources for the future.
Succession Planning
The Water Utilities Director is set to retire by the end of the year. Upon their departure the water
department will lose a vast amount of historical knowledge of the utility and expertise in the field. The
City has started a plan to begin a national search for the next water utility director. In the meantime, the
director has informally begun to prepare his direct reports to be able to assume more responsibility and
is training them on any knowledge gaps he foresees.
Long Term Water Planning
The city is pursuing several resources when it comes to Long term water planning. Planning is conducted
on a State, Regional and local level. The City works closely with neighboring cities, the Brazos River
Authority (BRA) and Region G to analyze and develop additional water resources available to meet the
City’s long-term needs. The BRA and the City of Georgetown are jointly funding and participating in an
Aquifer Storage and Recovery (ASR) Study. This study will look at seasonal recharge of surplus reservoir
water from Lake Georgetown, treating this water during times when there is spare water treatment
capacity and then conveying this water to a suitable location within aquifer(s) that can be used to store
the water. During periods of high-water demand or extended drought, the stored water may then be
recovered to meet water resource needs. This storage and utilization method may also be used to store
additional groundwater resources. The BRA, City of Round Rock and Georgetown are jointly participating
in a collaborative study to identify regional and long-term water solutions for Williamson county, the
evaluation will include groundwater and conjunctive water development opportunities that have been
presented by different marketing groups, water sharing and scenarios for potential redistribution of water
Page 23 of 173
RISK MITIGATION REPORT 19 | Page CITY OF GEORGETOWN
supplies for regional and long-term sustainability of water supplies in Williamson county. James (Jim)
Briggs, former Utility General Manager, has worked to include additional groundwater resources from
counties to the east as a long-term water resource within the Region G Plan. By having groundwater listed
as a long-term solution on the Region G plan, related projects will be eligible for state funding
participation.
System Interconnects
The City is further diversifying its water resources and increasing system resilience through interconnects
with neighboring systems. The City currently has two interconnects with Round Rock and a third under
design to utilize Round Rock’s excess treatment capacity. An additional short-term interconnect is also
constructed between the City and Leander’s system. This interconnect will be used during periods of high
demand. The use excess treatment capacity of others assists the city in being fiscally responsible in the
ability to defer capital construction when possible.
Water Leak Detection
In an effort to more responsibly utilize current water resources the City continues to track and trend Water
Loss as a key operating metric. Starting in Fiscal year 2021, the city will be improving leak detection by
using satellite detection. The City’s vast service area makes this method of detection and subsequent
repair more efficient.
Water Rates
The city continues to maintain utility fiscal health by performing rate study and impact fee studies every
three years. Previous rate studies were conducted on a revenue sufficiency principal. The rate study
currently is a cost-of-service rate study. The water rates and tiers were evaluated primarily for residential
customers and will be in effect 2021. Commercial tiers, and reclaimed use is to be analyzed in 2021.
Implementation of the new water rates and narrowed tiers will assist the utility in maintaining financial
integrity and make significant effort to improve resource use efficiency.
Public Works
Capital Improvement Project Coordination Committee
The lack of regularly scheduled CIP Coordination meetings outside of the annual budget process has led
to disjointed communication with the CMO on capital improvements projects and, at times, has limited
the ability of the organization to consider the full range of options as obstacles, challenges, and
opportunities have arisen. All of which is why a new internal committee is being created to enhance CIP
coordination across the City. Enhanced CIP coordination will save time, increase accountability, reduce
errors, improve timely project close-out, improve debt tracking and issuance, minimize
miscommunication, improve intergovernmental coordination, increase accuracy of billing to correct cost
centers, and increase opportunity to proactively respond to challenges, obstacles, and opportunities.
Contract Coordinator
The City of Georgetown hired a contract administrator in March of 2020. This role is responsible for
enhancing contract management for various types of agreements, by working with City staff to raise
additional awareness for upcoming obligations. Since being hired on the contract administrator has
assisted in modifying the internal cover sheet process for two major developments, this improvement led
Page 24 of 173
RISK MITIGATION REPORT 20 | Page CITY OF GEORGETOWN
to identifying over a million dollars in funds owed to the City for public infrastructure. This continuous
process and review by the contract administrator will allow for more detailed oversight in the growing
number of contracts as the City expands. The contract administrator created a tracking process to monitor
the monetary obligations owed to the City or what the city owes given contract specifications.
Also, a Contract Coordination Committee has been formed with its initial meeting scheduled for October
2020. This will further assist the City in working together to track obligations that need to be met. The
position will also be the liaison for the City regarding new MUDs and PIDs wishing to be created within
City limits and ETJ.
Near Term Action
Complete Hazard Mitigation Plan
Conduct a citywide operational and enterprise risk assessment every 5 years-with the next
study slated for FY23
Implement consultants’ recommendations as a result of the following studies:
o Gartner Assessment of CIS/AMI/MDM systems
o HIPAA Audit by SHI
Conduct an audit of the electric risk management practices
Finalize and initiate internal audit work plan
Process improvement
o Streamline purchasing process and create training for power users to ensure
compliance with procurement laws
o Integrated Council agenda process across the City Manager’s Office, City Secretary’s
Office, City Attorney’s Office and Purchasing department as well as creating and
implementing training for power users on the agenda process
Overall biannual review and update of citywide and departmental policies and procedures
Providing public dashboards of departmental performance management metrics
Page 25 of 173
RISK MITIGATION REPORT 21 | Page CITY OF GEORGETOWN
APPENDIX
Risk Mitigation Register
Page 26 of 173
RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS
R01 IT Cybersecurity
Governance Model
A comprehensive Information
Technology (IT) cybersecurity policy and
procedures document has not been
approved by management and
communicated to all employees and
relevant external parties, outlining
responsibility and oversight for
Information Security (IS) and policy
administration.
IT Director Chris Bryce 21
1) We recommend the City implement a governance framework
that allows for the proper management of a successful ISP. An
effective ISP involves participation from senior management to
set the direction for proper information security practices,
adequate staffing and compliance with policies
2) Further, we recommend the City adopt a practice of
performing a Cybersecurity risk assessment periodically. The
periodic approach may take either of the following approaches:
(A) performing a full assessment every other year due to
intensive resources required to facilitate such an exercise or, (B)
a targeted approach done annually including:
• revisiting this report findings and updating controls where
appropriate,
• re-assessing the City’s mitigation plan to update progress and
note any further concerns, and/or,
• selecting a few high-priority control areas (e.g. vendor
management, or any business objective/goal identified by
executive management) and re-assessing associated threats
related to those areas
1) Implementing IT Catalyst Plan – 5 year
Strategic Plan
2) Developing documented policies to address
various IT areas
3) Developing Cybersecurity Training
4) Conducted 2 security audits
5) Budgeting Lead System Security Analyst in
FY19
6) Conducting PCI (Payment Card Industry)
study (scheduled)
7) Implementing two factor authentication
8) IT Cybersecurity Risk Assessment by the US
Department of Homeland Security
9) Determine best practices, implement
security policies, and identify
staffing/challenges to implement ISP
10) Identify staffing needs to appropriately
manage IT security challenges and ISP
11) Continue Cybersecurity scanning on a
yearly basis.
12) Implement ISP
13) Assigned security roles to existing staff and
hired any security staff needed to manage an
Information Security Program
FULLY MITIGATED
1) The City has completed a
draft Cybersecurity policy
that is under review by
multiple departments. It is a
comprehensive policy that
establishes basic security
guidelines for all aspects of IT
services, infrastructure and
staff. The policy includes the
designation of Cybersecurity
officer in IT to lead
implementations. Upon
acceptance of the policy,
multiple PMP measures will
be instituted to measure
compliance with policy.
2) The City is currently
working with a consultant to
perform a study of HIPAA
related data security.
3) The City has conducted
and passed multiple security
assessments including those
conducted by U.S.
Department of Homeland
Security.
R02 Utility Market Exposure to fluctuations in the market
price of utilities
General Manager
of Electric Utilities
Daniel
Bethapudi 18.75
1) Continue to enhance the City’s forecasting tools and
techniques to increase granularity and improve accuracy.
2) Continue development of a strategy to meet future peak
demand growth with distributed generation and storage rather
than remote central generation to mitigate exposure to
transmission congestion.
1) Shell was hired to forecast and manage
purchasing power. Line extension policies and
a rate study by NewGen has been conducted
to ensure th electric utility is more resilient to a
fluctuation in market price.
2) Daniel Bethapudi was hired to oversee the
electric utility.
3) Risk Oversight Committee was created and
regular reporting to Council
PARTIALLY MITIGATED
RESPONSE
RISK LOG
RISK
RISK REGISTER
ASSESSMENT
Page 27 of 173
RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS
RESPONSE
RISK LOG
RISK ASSESSMENT
R03 IT Asset Management:
Data Classification
The data, personnel, devices, systems,
and facilities that enable the
organization to achieve business
purposes are identified and managed
consistent with their relative importance
to business objectives and the
organization’s risk strategy.
IT Director Chris Bryce 17
1) The City should consider classifying data within the system
based on its criticality and / or sensitivity (NIST SP 800-53 Rev. 4 RA-
2). Classification of data will also help drive the above-
mentioned information flow enforcement and help define the
City’s security architecture
2) We recommend the classification of City data to define an
appropriate set of protection levels and communication
required for special handling Classifications and associated
protective controls (including encryption for data at rest and
data leak prevention tools) should take into account
department needs for sharing or restricting information and the
associated business impacts if such data were compromised.
Successful data classification in an organization requires a
thorough understanding of where the organization’s data assets
reside and on what applications/devices they are stored.
Handling procedures should include details regarding the
secure processing, storage, transmission, declassification, and
destruction of data.
1) Implementing IT Catalyst Plan – 5 year
Strategic Plan
2) Implementing 2 factor authentication with
Workday
3) Implementing consistent role based access
to CIS and ERP system functions through
Workday
PARTIALLY MITIGATED
1) As part of the Cybersecurity
Policy under review, a Data
Management policy has been
created that lays out a multi-
department guidelines to
classify and manage sensitive
data.
R04 IT Access
Management
Access to assets and associated facilities
is limited to authorized users, processes,
or devices, and to authorized activities
and transactions.
IT Director Chris Bryce 17
1) A role-based access scheme should be established to ensure
consistent application of user access rights within the system.
Users should be assigned their base set of access authorizations
based on the concept of “Least Privilege Necessary” to perform
their role or job function (as defined within their formal job
description). Additional access beyond the previously
established role-based access scheme should be formally
requested, reviewed for conflicts and approved (NIST SP 800-53
Rev. 4 AC-2). Moreover, Management should consider
integrating access rights with data classification efforts identified
in Appendix B of this report 2) Ensure a process is in place to
approve special access requests and timely de-provision access
upon notification from HR
1) Roles and access defined in policy and set
in Workday. SCADA is being audited by
Homeland Security and will see
recommendations to mitigate potential risks.
FULLY MITIGATED
1) As a first step in meeting these
requirements, the City has
established a Cyber Security
policy. As sub policy, that
policy includes guidelines on
access management. Upon
acceptance of the policy, IT will
begin implementing aspects of
the policy pertaining to IT.
2) IT has implemented an
approval process in its ticketing
systems for both access
requests and change control on
major systems.
R05 IT Contingency Plan
Loss or inability to continue business due
to natural disaster, system capacity or
performance issues, interruption in
communication, loss or corruption of
data, or loss of critical vendors or staff
members.
IT Director Chris Bryce 17
Plante Moran recommends the City conduct and formalize: (1)
A Business Impact Analysis (BIA) which identifies and analyzes
mission-critical business functions, and then quantifies the impact
a loss of those functions would have on the City, and (2) An
information system contingency plan to mitigate the risk of
critical system and service unavailability. The contingency
planning process should occur after a formal Business Impact
Analysis (BIA) is conducted, in order to correlate the system with
the critical processes and services provided, and based on that
information, characterize the consequences of a disruption.
Three steps are typically involved in accomplishing the BIA: •
Determine mission/business processes and recovery criticality •
Identify resource requirements • Identify recovery priorities for
system resources
Preparedness committee in partnership with IT PARTIALLY MITIGATED The City will conduct this as part
of a Business Continuity Plan
Page 28 of 173
RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS
RESPONSE
RISK LOG
RISK ASSESSMENT
R06 Segregation of Duties
The Organization fails to adequately
segregate roles and tasks between team
members
Finance Director Leigh
Wallace 16.43
1) An annual review of user access for all staff members within
the City across all programs managed by IT should be
performed
2) Departments that have not had an internal control review
within the past five years should evaluate the design and
effectiveness of their internal controls
Workday ERP system requires role-based
security assignments. The Workday ERP system
requires 2-factor authentication to access the
system.
FULLY MITIGATED
R07 Legislation
Governmental laws change that impact
the organization by financial, operating,
strategic or compliance issues.
CMO
David,
Laurie, and
Wayne
16.36
1) Council and Management should review and closely monitor
the status of annexation plans for the City. After the 2020 census,
the City will be limited in its ability to perform annexations due to
Williamson County’s population surpassing 500,000 citizens
2) The City should work with legislators to clarify the impact of
harmful legislation including revenue caps and limits on debt
financing for infrastructure during the City’s period of high growth
and should stress the removal of local control restrictions that
impact citizens ability to impart changes in their local community
1) Staff reviews annexations and carefully
plans in DPRC
2) Focused Advocacy was contracted as a
lobbyist for the City to inform the City of
developing and implemented legislation and
its affects; as well as lobbies in the City's best
interest
PARTIALLY MITIGATED
City is creating a Legislative Task
Force with representation from
the community to inform the
City's legislative agenda.
R08
Emergency
Notification System
Failure (ENSF)
The City's Emergency Notification System
fails to alert citizens in the event of an
emergency.
Emergency
Management
Coordinator
Raymond
Mejia 13.81
1) The City should communicate Incident Action Plans for large
scale events to all parties involved with the event, including the
Convention and Visitors Bureau (CVB) 2) Management should
inform all departments of the operating procedures related to
the ENSF 3) The EMC should develop basic and advanced
emergency management training for key stakeholders in the City
(Division Managers) and conduct table top and/or practical
training exercises that replicate local level emergencies
1) Incident Action Plans are created and
shared with needed stakeholders. With COVID-
19 Situational Reports and IAP's were created
after EOC meetings and shared with
stakeholders.
2)
3) Creation of Preparedness Committee which
is working on several emergency management
deliverables to better prepare the organization
as a whole.
1) Work with utilities to map
a process flow to send out
alerts (e.g. boil water
notices)
PARTIALLY MITIGATED
1) Creation of Continuity of
Operations Plan
2) Tabletop exercises
completed quarterly throughout
the year with Directors
3) Create EOC training and
emergency management
training for staff on the LMS
Page 29 of 173
RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS
RESPONSE
RISK LOG
RISK ASSESSMENT
R09 Fraud
Customer, third party, or internal fraud
occurs resulting in a significant
misappropriation of assets and/ or
incorrect financial reporting, or
corruption/ kickback schemes.
Controller Elaine
Wilson 13.75
1) The Finance Department should perform more robust reviews
of P-Card purchases and consider utilizing software to perform
regular audits of P-Cards
2) The Finance Department should perform annual reviews of P-
Card users to evaluate whether the all users actually need P-
Cards
3) The City should implement a more extensive asset tracking
program, utilizing fixed asset tags on assets valued over $1,000
with consideration of periodic asset audits
4) Vendor Ship-To addresses should be limited to a “drop down”
list consisting only of City facilities
5) The City should consider developing a fraud awareness and
prevention training program with active participants across all
City departments
6) All changes to IT databases deemed to be material should be
tracked on an Audit File Log and reviewed by someone without
access to the databases
1) A review of all P-card users was performed
during the Workday ERP conversion. Cards
were added and reduced as necessary across
departments. Several departments turned in
individual cards used infrequently, and
switched to shared cards monitored by a card
liaison. The total number of cards remained the
same across the City. Travel requests are now
audited before the event occurs, in addition to
after the event occurs. This has improved
accuracy of travel expenses
2) P and T Card review was done this year with
the issuance of new cards
3) Some departments are beginning asset
management programs
4) Workday limits ship to address options
5) Cash handling training is required for those
handling cash
6) Several levels of reviews for changes to IT
database and regularly audited and checked
for weaknesses by Department of Homeland
Security
PARTIALLY MITIGATED
Have regular audits conducted
of processes prone or
vulnerable to fraud
R10 Health & Safety
Exposure to potentially significant
workers' compensation liabilities due to
the inability to maintain compliance with
applicable health and safety laws and
regulations.
HR Director Tadd
Phillips 13.04
Overall, the City has robust health and safety procedures and
should consider adding the following:
1) The Library should develop clear policies and procedures on
a course of action when a customer, employee, or volunteer is
injured at the facility.
2) The City should review the lifeguard policy for pool facility
rentals. The City currently does not provide a lifeguard for pool
rentals by the Georgetown Independent School District and
does not require GISD to provide their own lifeguard.
3) Consider adding an Active Shooter response plan
1) Centralized safety and risk management
team as of Oct. 1, 2019
2) GISD and the City are working on an
interlocal agreement that will mitigate the
safety risks.
3)November and December active shooter
and fire safety training at several City facilitates
FULLY MITIGATED
Page 30 of 173
RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS
RESPONSE
RISK LOG
RISK ASSESSMENT
R11 IT Incident Response
Management
Response processes and procedures are
executed and maintained, to ensure
timely response to detected
cybersecurity events
IT Director Chris Bryce 12
We recommend the City implement a formal incident response
plan including: 1) Provide a roadmap for implementing its
incident response capability; 2) Describes the structure and
organization of City of Georgetown’s incident response
capability; 3) Provides a high-level approach for how the
incident response capability fits into City of Georgetown as a
whole and the overall Family of Companies; 4) Meets the unique
requirements of City of Georgetown’s mission, size, structure, and
functions; 5) Defines reportable incidents as well as requirements
and guidelines for external communications and information
sharing (e.g., what can be shared with whom, when, and over
what channel); 6) Provides metrics for measuring the incident
response capability within the organization; 7) Defines the
resources and management support needed to effectively
maintain and mature an incident response capability; and 8) Is
reviewed and approved by senior management
Preparedness committee is devloping a
hazard mitigation plan that will address these
across departments including IT
PARTIALLY MITIGATED
Preparedness committee is
devloping a hazard
mitigation plan that will
address these across
departments including IT
R12 Utility Outage
The City is unable to respond to mass
failures of electrical, water, or sewage
outages in a timely manner.
Utility Director Glenn
Dishong 11.89
1) Maintain equipment useful lives schedule and proactively
monitor components which have reached their useful lives
2) Perform a vulnerability assessment to judge your preparedness
for handling the increased likelihood for power outages
1) Assets are being monitored as well as their
useful lives.
2) Risk and vulnerability assessment was
conducted.
PARTIALLY MITIGATED Continuity of operation plan
and playbook for utility outage.
R13 Access to Talent Organization lacks sufficient staffing
levels to carry out its routine operations. HR Director Tadd
Phillips 11.75
1) The City should evaluate positions with required specialized
certifications and determine whether entry level staff members
can obtain certifications after hire
2) For specialized positions, including, but not limited to, building
inspectors, paving foremen, and traffic engineers, the City
should conduct an assessment of staffing levels with a 3-year
outlook 3) The Fire Department should develop a plan to
acquire the necessary EMS personnel talent
1) Several key departments are initializing step
programs to promote staff retention and
development for more specialized roles.
2) Many departments utilize metrics to gauge
staffing needs with an outlook of a few years.
3) Fire continues to study the needed
personnel and requests staff in the budget
process. FS 6 and 7 will have the adequate
staff to operate.
FULLY MITIGATED
Establish a process to identify
staffing level needs with a 3-5
year outlook.
R14
Disaster Recovery /
Business Continuity
Planning
Inability of the organization to continue
key business processes during a potential
disaster due to lack of sufficient disaster
recovery planning and/or execution.
CMO
David,
Laurie, and
Wayne
11.6
1) The City has inconsistent DR/BCP across the organization.
Some departments have a robust plan and others have none. A
DR/BCP should be developed for every City department. Each
of these department-level plans should then be integrated into
a city-wide plan
2) Tabletop disaster recovery simulations should be performed
with all City Departments
1) Business plans have been completed by all
departments with their budgets for 2021.
2) Emergency management coordinator is
developing policies and procedures as well as
tabletop exercises;
2) Disaster Preparedness Committee has been
created
PARTIALLY MITIGATED
1) Policies and procedures
developed, adopted, and
training given to all employees.
2) Tabletop exercises
completed quarterly throughout
the year with Directors
3+L11) Workday is a cloud
system, meaning it is accessible
anywhere with an internet
connection, including mobile
devices.
Page 31 of 173
RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS
RESPONSE
RISK LOG
RISK ASSESSMENT
R15 Billing for Citizen
Services
Citizens are billed incorrect amounts or
not billed at all for citizen services
Customer Care
Director
Leticia
Zavala 11.37
a. The fine schedule for the Municipal Court citations should be
restricted to specific users
b. All invoices should be created in a single system across the
City and remit-to addresses should be limited by a “drop-down”
function consisting of only addresses the City accepts payments
c. Management should consider a third party revenue
recognition study to validate all sources of revenue are
complete and accurate across the City operations
d. An outside party, Emergicon, reviews billing for EMS incidents
as there are various rates depending on citizen’s ability to pay.
Emergicon also collects funds and this helps reduce the
occurrence of billing errors and improves collections. However,
Emergicon also writes off funds and there is no reconciliation of
EMS revenue to billings. We recommend the City enhance
reconciliation controls around billing procedures and perform
internal audits of quality control and verification of vendor
compliance.
1) AMI/MDM and CIS systems are currently
being reviewed by a third party to identify
efficiencies and recommend processes to
reduce billing inaccuracies as well as other
issues with the systems
PARTIALLY MITIGATED
1) Implement changes
recommended by Garner's
study of the AMI.MDM and CIS
system
R16 Composition of Tax
Base
Changes in the balance of commercial
and residential tax base result in losses of
revenue from taxes.
CMO
David,
Laurie, and
Wayne
10.63
1) The City should communicate potential new commercial and
residential development to directly impacted City departments
and evaluate how new development would affect each
directly impacted department
2) Management should utilize a concentration strategy that is
flexible and supported by realistic expectations
1) City can use the Fiscal Impact Model to
estimate the cost to serve and its impact on
city services with new developments; DPRC
also serves as a vehicle to consider new
developments and its impact
FULLY MITIGATED
R17 Grant Obligations Organization fails to meet grant
covenant requirements. Controller Elaine
Wilson 10.55
1) The City should designate a staff member as a Grant
Administrator. This staff member should be responsible for
maintaining a repository of all grants being applied for,
awarded, contact person, and any required filings associated
with each grant. City should require that all Grants be managed
through the new Grant Administrator
2) A Grant Status Report should be provided on a periodic basis
to the City Manager’s office for potential budget considerations
1) Elaine Wilson is the grant administrator and
staff does the reporting for grants. Policy
created and training is done with departments
with active grants.
2) Quarterly Financial Report includes grant
report which is validated by Controller.
FULLY MITIGATED
R18 IT Third Party Roles &
Responsibilities
Security roles and responsibilities are not
established for all third-party service
providers and lack clear contractual
obligations for service level agreements
and KPI’s.
IT Director Chris Bryce 10
We recommend management take the following actions:
1) Clearly identify the cybersecurity responsibilities to be outlined
in the contract with the service provider including roles for
identification, response, and recovery procedures
2) Establish Key performance indicators for third-party
responsibilities including number of events, data breaches,
number of notifications
3) Continuously monitor contract SLA’s and established key
performance indicators
PARTIALLY MITIGATED
This is a low priority risk as IT
infrastructure is managed in-
house. As part of the new
Cybersecurity Policy under
review, a Vendor Access policy
will cover basic guidelines for
vendors.
Page 32 of 173
RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS
RESPONSE
RISK LOG
RISK ASSESSMENT
R19 Vendor Reliance
Any termination of, or adverse change
in, the Organization's relationships with its
key suppliers, or loss of the supplies in
support of one of the organization’s key
services
Purchasing
Manager Leah Neal 9.81
1) Assign one person the responsibility of monitoring all key
vendors to the City
2) Create a subsidiary listing of all key vendors with contract
details, SLA’s and performance metrics
3) Report back to City Manager when it is determined a vendor
may become insolvent or is not meeting SLA’s
4) Prior to contract renewal, negotiate with all key vendors to
capture volume discounts and preferred pricing
5) Management indicated Garland Power & Light currently
reconciles their meter data to the scheduling data and the
transaction settlement engine. This could be done in house but
would require additional headcount as the process runs 24/7.
Management should consider a cost/ benefit study to do this in-
house
1) Not realistic, but procurement could have
oversight with contract monitors in each
department
2) Existing contracts do not have performance
measures built-in. Contracts need more
specificity to identify indicators of
performance. Contract specialist could help in
this area to create a standard for contracts
moving forward. Performance of contracts
should be done more so on the power user
level, but processes should be put in place.
5) Gartner study is identifying best practices
and gaps with current MDM/CIS system. There
is also a multi-department initiative beginning
soon that aims to find efficiencies and
streamline the meter-to-cash processes
PARTIALLY MITIGATED
1) Create a sole source policy;
vendors should not be the ones
to verify that they are sole
source and a approval process
for sole source needs to be
created.
2) Create a better process of
procurement; often contracts
and purchases on the Council
agenda have never been
reviewed by the purchasing
team. Training recommended
for staff on procurement
process.
3) Contract Review Committee
with members from key
stakeholders involved (e.g.
Purchasing, Legal, CMO, etc.)
to follow best practice and
keep all parties apprised of
contracts within the City
R20 Physical Security Facilities are not appropriately secured
from unauthorized access. Facilities Eric
Johnson 9
1) Consider taking inventory of all key cards to validate none
have been stolen or lost
2) Consider development of physical security training for all
personnel regarding safeguarding of assets, restrictive access to
high risk areas, etc. The City must support integrity of physical
security through the organization with the assistance of the City’s
Risk Manager
3) Standardize a consistent security plan across all locations
appropriate for each facility
4) The City currently monitors physical access to the facility
where IT resides to detect and respond to physical security
incidents. However, CoG does not review physical access logs
periodically
1) Staff is working on this with the police
department, and access is monitored for
irregularities.
2) New city buildings were built with security in
mind, older buildings are being renovated with
employee safety as a priority.
3) The safety team in HR & OD is working on
creating a safety plan across all facilities;
Emergency Response Plan is also available
and being updated.
4) The City monitors when an incident occurs or
access usage is used out of the normal
operating times or pattern usually seen from
whomever is accessing the building.
PARTIALLY MITIGATED
1) Create a formal security
access policy
2) Conduct safety training or
create training in the LMS for
threats such as active shooter
and natural disaster like a
tornado in the area
3) Remodel GMC to have
better safety and controlled
access for employees
Page 33 of 173
RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS
RESPONSE
RISK LOG
RISK ASSESSMENT
R21 IT Critical Security
Event Identification
A formal risk event identification process
is not in place to identify, classify and
resolve security events
IT Director Chris Bryce 9
1) Identify high risk events that can be alerted from current
logging capabilities (NIST SP 80053 Rev. 4 AU-6). Potential high
risk events can be discerned through the risk assessment process
(NIST SP 800-53 Rev. 4 RA-3), penetration testing, and best
practice documentation. Some common threat events include:
• Multiple failed login attempts • Elevations in access privileges
• Changes to application code • Changes to security settings •
Process specific actions
2) Consider alert generation techniques for risky events such as
devices that connect to the network without authorization 3)
Identified events should be responded to in accordance with
the organization’s Incident Response Plan
The City's current Cybersecurity Officer and
Operations Staff monitor cybersecurity events. PARTIALLY MITIGATED
When economic conditions
allow, IT intends to implement a
Security Information and Event
Management (SIEM) system for
improved monitoring of security
events.
R22 IT Security Awareness,
Training and Education
Personnel are not informed of potential IT
threats to the organization and are
unable to respond effectively
IT Director Chris Bryce 9
1) Rely on end users as the first line of defense to limit exposure to
social engineering frauds and threats 2) Consider increasing
complexity of password requirements 3) Create a formal IT
Awareness training and provide to all employees on a periodic
basis 4) Require employees to formally acknowledge in writing
that they have read and understand the security awareness
training, and that they recognize the ramifications of non-
compliance
In FY 20, the City implemented a Security
Awareness policy that includes a requirement
that all employees conduct Cybersecurity
Awareness training.
PARTIALLY MITIGATED
All employees completed this
training and will do so annually.
The new policy, currently under
review, will also require
additional training for
employees who handle
sensitive data.
R23 Fire Department Failure
The Fire Department is not adequately
equipped to handle responses to
emergencies in the City.
Fire Chief John
Sullivan 8
1) Consider an independent third party evaluation study of the
GFD capabilities, response metrics and resource allocations to
evaluate if there needs to be changes to the current resource
allocation model
2) Consider cooperative agreements with ESD8 and/or
contiguous municipalities to elevate synergistic programs (co-
located/co-operated) fire stations and boundary drops
(enhanced auto-aid).
3) Consider making licensed buildings be required to be
inspected annually. Also, consider a self inspection program for
low risk properties and/or an inspection matrix as follows: • Low
Risk – every 3 years • Medium Risk – every 2 years • High Risk –
annually
4) Management should consider the implications for property
owners and businesses when the Public Protection Classification
(PPC) issued by the Insurance Services Organization (ISO) is not
performed, as there may be a negative impact if not inspected
annually.
1) Hired technical advisory; Community risk
assessment and strategic plan for
accreditation Spring 2021.
2) Finalized a 10 year contract; ESD 3& 5 auto-
aid with Williamson, Travis, and Round Rock.
Fire station 6 is now open in ESD8.
3) Not needed at this time.
1) Fire Marshall
2) Fire Protection Engineer PARTIALLY MITIGATED
R24 Freedom of
Information Act (FOIA)Non-compliance with FOIA requests City Secretary Robyn
Densmore 6.22
1) When the transfer of FOIA request process is complete,
consider documenting the process with written policies and
procedures
FOIA policy and procedure created and
presented to Directors. City has a full time
open records specialist.
Additional open records
specialist due to the
continued increase in
volume of open records
requests.
FULLY MITIGATED Continue annual staff trainings
on open records requests
Page 34 of 173
RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS
RESPONSE
RISK LOG
RISK ASSESSMENT
R25 Police Failure
The Police Department is inadequately
equipped to respond to emergencies or
responds in an unauthorized manner.
Police Chief Wayne
Nero 6
1) Develop the following Key Risk Indicators (KRI’s) and
monitoring controls which may indicate a risk event is about to
occur a. Increase in City crime rates b. Increase in police
misconduct/brutality incident claims c. Increase in squad car
accidents d. Excessive overtime e. Unexpected cost
overruns/continuous unfavorable budget variances f. Increase
in dismissed cases due to insufficient evidence, improper
procedures or failure to follow legal standards for police
1) Metrics for monitoring are closely monitored
for trends and shared with CMO and Council.
These metrics guide decisions made by the
Police chief.
B.) Every incident is reviewed/investigated,
monthly management report reviewed, and
guardian tracking has an early warning system
for personnel exhibiting certain performance
indicators that triggers higher level review of
officer
C.) Reviewed and investigated and included
in monthly mismanagement report and added
to officers file for tracking of patterns.
D.) OT monitored every pay period with various
measures and historical reviewed
E. Costs tracked internally and in workday
FULLY MITIGATED
R26 Talent Management
Organization lacks a clear assessment
and evaluation process to align qualified
employees with specific business
requirements and needs.
HR Director Tadd
Phillips 5.42
1) Have HR department work collaboratively with business lines
to gain in depth knowledge of resource needs and constraints
2) Consider using an outside party for diversity in pre-hire
assessments
1. Directors oversee their departments and
align those best qualified to fill gaps in their
organization through promotion or lateral shifts.
FULLY MITIGATED
Learning and development
survey was conducted , city
staff were asked to identify their
needs for professional
development.
R27 Records Management
No records management policy is in
place, adhered to, or is inadequately
designed.
Records Program
Manager
Cynthia
Conomos 5.27
1) Formalize Records Management policy regarding digital
records and communicate to all departments
2) Consider additional training on electronic records
management
3) Consider digitizing Parks & Recreation forms
1) Records management program has an
existing policy from 2015, revised in 2019. Team
is currently in the process of their records
management survey.
2) Began a finance electronic record cleanup
to help clear records that met retention and
organize files for Finance.
3) Digitizing forms in progress
Records specialist to
maintain with the rate of
new requests
FULLY MITIGATED
Records team is working with all
departments on their records
retention program and
conducting training.
Page 35 of 173
RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS
RESPONSE
RISK LOG
RISK ASSESSMENT
R28 Regulatory Filings Failure to comply with regulatory filings
such as GASB, EPA, etc. Controller Elaine
Wilson 5.2
1) Agency (EPA) and Texas Commission on Environmental
Quality (TCEQ) permit reports every 3-5 years
2) Finance prepares annual CAFR and SEFA which is submitted
to the clearinghouse
3) Customer Care prepares annual filings on storm water use
survey breaking out how much water was taken in to the system.
4) City of Georgetown has an exemption from complying and
filing necessary reports mandated by Senate Bill 898 (reducing
energy consumption in City owned facilities) & administered via
the State Energy Conservation Offices (SECO) because of the
100% renewable designation. 5) Customer Care is required by
TCEQ to report water quality testing results to customers on an
annual basis. Deadline for customer communications is 7/1. GUS
must certify with TCEQ by 5/1 that we provided water quality
testing results to water purveyors that obtain wholesale water
from GUS.
6) Energy Services relies on outsource provider Snyder
Engineering for all regulatory findings
7) Utility services is subject to an annual requirement with the
ERCOT to validate that a risk management plan is in place
8) Airport has a significant amount of regulatory filings ranging
from EPA, TCEQ, Stormwater, Airplane inventory, and Property
Taxes through MCAT. Use Microsoft Outlook as reminders
9) Fire Dept. has numerous state health services filings regarding
training, certifications, incidents, fatalities, etc.
1) Each department is responsible for
compliance at the state and federal level and
they do so regulalry to comply with deadlines.
FULLY MITIGATED
R29 Succession Planning
Leadership talent within the organization
is insufficiently developed to provide for
orderly succession in the future.
HR Director Tadd
Phillips 4.39
1) The City should consider an outside party to implement a
formal Succession Plan
2) Consider a mentor shadowing program to protect the City
against unplanned terminations or leaves of absences
1) Engaged leaders program allows for
leadership development. Directors informally
plan succession by training assistant directors
or identifying d individuals they believe might
be right for the job. National searches are
done externally to also fill roles with the best
candidate.
2) City is establish its organizational
development department within HR which will
facilitate the creation of programs that will
bolster professional development and any
other needs of staff identified in the City-wide
needs assessment.
PARTIALLY MITIGATED
Learning and development
survey was conducted , city
staff were asked to identify their
needs for professional
development. Several
departments have
incorporated cross-training and
succession planning into their
operations.
Page 36 of 173
RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS
RESPONSE
RISK LOG
RISK ASSESSMENT
R30 Budget and Planning
Budgets and business plans are not
realistic, based on appropriate
assumptions, based on cost drivers and
performance measures, accepted by
key managers, or useful or used as a
monitoring tool.
Finance Director Leigh
Wallace 3.24
1) Certain departments such as utilities, water, electric, etc.
count on supplemental data to prepare their budget (see Data
Governance risk #27). We recommend management validate
and document the completeness and accuracy of assumptions
for all budget line items
2) Management should set a clearly defined threshold for all
material variances to be explained (e.g. +/-XX% and $YY,YYY)
1. New business plans were developed tying
KPI's with the goals of that department and the
mission.
2. Budget process requires several reviews and
checks by analysts and executives to ensure
budget lines are appropriate.
The budget development
module of the Workday
ERP system is currently
being implemented.
Finance participates in the
rate studies and
supplemental consultant
financial models for the
utilities.
PARTIALLY MITIGATED 1) Create a budget with a more
detailed 5 year outlook
R31 Tax Non-compliance with state or federal tax
law. Controller Elaine
Wilson 3 1) Consider the creation of a master tax filing schedule and
reporting to City Manager N/A NOT MITIGATED
1) Create master tax filing
schedule after Workday
implementation
R32 State/Federal
Regulations
Failure to comply with new or existing
federal or state regulations. Controller Elaine
Wilson 2.44
1) Develop a Citywide license and CPE tracking system
2) Develop a process to ensure all City playgrounds comply with
ASTM F1487-07. The code does not require a formal inspections
process, just that the City complies with the ASTM F1487-07
standard
1) Workday has capability to track
development and performance, but is not
being used as the city develops it learning and
development program
2) City utilizes third party's to design and
construct playgrounds who are aware of state
and federal regulations
PARTIALLY MITIGATED 1) Consider tracking CPE's
through Workday
R33 Leadership
The people responsible for the important
City processes do not or cannot provide
the leadership, vision, and support
necessary to help employees be
effective and successful in their jobs.
CMO
David,
Laurie, and
Wayne
2.42
1) The City should consider an upward feedback program to
validate lower levels of employees are satisfied with
management’s performance
1) Currently focused feedbacks are in place
which are a two-way feedback of the
employee and supervisor; Supervisors are
evaluated in 360 evaluations by peers;
employee engagement surveys are done bi-
annually and provide a feedback mechanism
as well anonymously
2) More regular feedback is encouraged with
the use of the Diamond Drop program
FULLY MITIGATED
IMPACT / OCCURRENCE LIKELIHOOD LEVEL 2018 Risks Fully Mitigated Partially Mitigated Not Mitigated
HIGH MEDIUM LOW HIGH 5 2 3 0
5 17 11 MEDIUM 17 5 12 0
LOW 11 6 4 1
Fully Mitigated
Partially
Mitigated
Not
Mitigated Total 33 39%58%3%
13 19 1
2018 Risks
TOTAL
REGISTER DROPDOWN KEYS
IMPACT / OCCURRENCE
LIKELIHOOD LEVEL
MITIGATION STATUS
Page 37 of 173
Risk Mitigation Report
Page 38 of 173
OVERVIEW
•Introduction
•2018 Risk Assessment
•Mitigation Completed
•Near Term Actions
Page 39 of 173
RISK CYCLE
1. Risk
Identification
2. Risk
Assessment
3. Risk
Mitigation,
Planning, and
Implementation
4. Risk and
Mitigation
Tracking
Page 40 of 173
DEPARTMENTS/DIVISIONS
•City Secretary
•City Manager’s Office
•Controller
•Emergency Management
•Facilities
•Finance
•Fire
•Human Resources
•Information Technology
•Parks
•Police
•Purchasing
•Records
•Utility (Customer Care, Water and
Electric)
Page 41 of 173
RISK UNIVERSE
City of Georgetown Risk Universe
Access to Talent IT Security Awareness, Training, and Education
Billing for Citizen Services IT Third Party Roles and Responsibilities
Budget and Planning Leadership
Composition of Tax Base Legislation
Disaster Recovery/Business Continuity Physical Security
Emergency Notification System Failure Police failure
Fire Department Failure Records Management
Freedom of Information Act (FOIA)Regulatory Filings
Fraud Segregation of Duties
Grant Obligations State-Fed Regulations
Health & Safety Succession Planning
IT Access Management Talent Management
IT Asset Management: Data Classification Tax
IT contingency Plan Utility market
IT Critical Security Event Identification Utility Outage
IT Cybersecurity Governance Model Vendor Reliance
IT Incident Response Management
Page 42 of 173
11
14 14 15
12
14
12
14 14 14 15
19
14 13 14 14
9
14 13 12 12
14 14
12
14
4
4
1
2 3
2
2 3 1
2
4
3 1 1
6
4
4
2 3
1
1
2
2
3
3
3
1
4
3
1
1
1 1
4
3
3
3
0
5
10
15
20
25
30
AIR ASV ATT COD COM CRT CUS CVB ECO ENG FIN GFD GPD GUS PLH HUR BINS ITS LIB MGR PRK SEC SWR TSP WSV
2018 Residual Risks by KBD
Low 1-8 Med 9-16 High 17>
Page 43 of 173
MITIGATION SUMMARY
IMPACT / OCCURRENCE
LIKELIHOOD LEVEL 2018 Risks Fully
Mitigated
Partially
Mitigated Not Mitigated
HIGH 5 2 3 0
MEDIUM 17 5 12 0
LOW 11 6 4 1
Total 33 39%58%3%
Page 44 of 173
SIGNIFICANT CHANGES SINCE 2018
•Electric Utility -Energy Portfolio
Management
•Reorganization of City
•Workday ERP
•COVID-19
•Impact On FY2020 Budget
And Beyond
•Lost EMS iPad
•Possible HIPAA Breach
•Senate Bill 2 (revenue caps)
•Shot Clock Legislation
•Back-Up Data Center
Page 45 of 173
MITIGATION-INFORMATION TECHNOLOGY
•Cybersecurity Policy
•System and Network Contingency Plan
•Security Information and Event Management System
•IT Security and Awareness Training
•Secondary Back-Up Data Center
•Department of Homeland Security Audit
Page 46 of 173
MITIGATION-PUBLIC SAFETY
•HIPAA Audit
•Guardian Tracking –Police Performance Management Software
•CommUNITY Advisory Task Force
•Police Training –Arbinger Institute
•Replacement of Police Body Cameras
•Fire Station 6 & 7
Page 47 of 173
MITIGATION
•Emergency Management
•COVID -19 Response
•Hazard Mitigation Action Plan
•City Secretary’s Office
•Freedom of Information Act
•Records Management
•Facilities
•Facility Access Policy
•GMC and LWW Remodel
Page 48 of 173
MITIGATION –CITY MANAGER’S OFFICE
•Organizational Performance Management
•Departmental Business Plans
•Legislative Advocacy
Page 49 of 173
MITIGATION -FINANCE
•Financial and HR Management –Workday
•Internal Audit Plan
•Fee Collection Revenue
•Hotel/Motel
•Franchise Fees
•Airport Revenue
•Sales Tax Audit of City Enterprise Revenue
Page 50 of 173
MITIGATION –HUMAN RESOURCES
•Organizational Development
•Organizational & Operational Excellence Office (OOE)
•Learning and Development Coordinator and Plan
•Policy Updates
•Temporary COVID -19 Related
•Workday Implementation
•Safety and Risk Management Team
•Citywide
Page 51 of 173
MITIGATION -UTILITIES
•Weaver Assessment
•Cash Receipt Review
•UMAX Business Process Mapping
•Gartner Assessment
•Customer Information System (CIS), Advanced Metering Infrastructure
(AMI) and Meter Data Management (MDM) systems
Page 52 of 173
MITIGATION -ELECTRIC
•Energy Risk Management Program
•Risk Oversight Committee
•Risk Management Committee
•3rd Party Electric Portfolio Management
•Electric Advisory Board
•Line Extension and Meter Connect Revenue
Page 53 of 173
MITIGATION -WATER
•Risk Assessment
•Succession Planning
•Water Rate Study
•Long Term Water Planning
•System Interconnects
•Capital Improvement Projects
•Water Leak Detection
Page 54 of 173
NEAR TERM ACTIONS
Conduct a citywide operational and enterprise risk assessment every 5 years-
with the next study slated for FY23
Complete Hazard Mitigation Plan
Implement consultants’recommendations as a result of the following
studies:
o Gartner Assessment of CIS/AMI/MDM systems
o HIPAA Audit by SHI
Page 55 of 173
NEAR TERM ACTIONS (Cont.)
Finalize and initiate internal/external audit work plan
Process improvement:
o Streamline purchasing process and create training for power users to ensure
compliance with procurement laws
o Integrated Council agenda process across the City Manager’s Office,City
Secretary’s Office,City Attorney’s Office and Purchasing department as well as
creating and implementing training for power users on the agenda process
Overall review every 2 years of citywide and departmental policies and procedures
Providing public dashboards of departmental performance management metrics
Page 56 of 173
QUESTIONS?
Page 57 of 173
City of Georgetown
UMAX Process Evaluation
Points for Consideration (PFC) Matrix
September 2018
Area Ref #Condition Risk or Exposure Risk Rating Recommendation PFC Type Management Response JANUARY 2019 FINAL RESPONSE NOVEMBER 2020 Mitigation Status Status Action Item
No
Category NC-01
The City of Georgetown manually enters online customer application
information into the UMAX system when setting up new customer
accounts.
The City of Georgetown may
experience inefficiencies in
processing online customer
applications and
opportunities for data errors.
Low
The City of Georgetown should inquire with the vendor
and determine if the online application can be
integrated into UMAX in the appropriate corresponding
fields.
Integration
Management's Response:
Not originally scoped in the CIS project, however will
work with vendor to determine a cost estimate and
timeline for enhancement.
Responsible Party: Customer Care, Business Systems,
IT
Implementation Date: 2019-20
Customer applications (for initiation (NC-01) and cancellation of service) are accepted on the
utility website via an on-line form (Formstack). The application is then automatically routed to the
Account Management workgroup to enter the information into UMAX. An automated process
within the CIS system (via their CSS customer portal) is available on the more recent CLOUD 365
version of the CIS. This enhancement would require additional funds to implement in our current
ONSITE version of the software.
Not Mitigated Not Started Scope in new CIS
upgrade
No
Category NC-02
The City of Georgetown does not have a process in place for
reconciling customer accounts that are subject to deposits in UMAX
with the General Ledger deposit account.
The City of Georgetown could
waive deposits for customers
who do not meet the
approved criteria.
Moderate
The City of Georgetown should develop a report to
reconcile the customer accounts in UMAX that are
subject to a deposit, with the value of the General
Ledger deposit liability accounts.
Reporting
Management's Response:
Developing ad hoc reporting tools to assist with
analysis
Responsible Party: Customer Care, Business Systems,
IT
Implementation Date: 2018-19
Deposits are automatically charged to all new accounts set up in UMAX. Reps can waive the
deposit (based on established criteria) in the UMAX system and must include a reason code. A
report that provides a listing of all accounts set up during a date range, was created and is
reveiwed by management on a monthly basis.
Mitigated Complete
No
Category NC-03
The City of Georgetown has procedures in place that require another
employee to review customer application information manually
entered into UMAX for completeness and accuracy. However, UMAX
does not restrict Customer Care Representatives from reviewing their
own application data entries.
The City of Georgetown may
set up new customer
accounts incompletely or
inaccurately within the UMAX
system.
Moderate
The City of Georgetown should consider implementing
functionality in UMAX that will restrict Account
Management personnel from reviewing entries performed
by the same user. Alternatively, the City of Georgetown
could assign a second user ID to be used, in times of staff
shortages, for personnel to review their own work
accompanied by a report that is reviewed by UBO
management.
User Access
Management's Response:
Review of UMAX user access to determine
appropriate segregation of duties within current
staffing levels
Responsible Party: Customer Care, Business Systems,
IT
Implementation Date: 2019-20
This is related to NC-01 above. As mentioned above, the Account Management workgroup
enters the application information into the UMAX system and a member of the Billing workgroup
reviews the data entered and identifies any anomolies.
Mitigated Complete
Billing and
Invoice,
Usage
Reconciliat
ion
BI-01
The City of Georgetown does not have procedures in place to
reconcile meter reads and customer account data transfers between
UMAX and UCENTRA. Nightly, UMAX transfers customer account
information to UCENTRA, so UCENTRA knows which utility meters
require readings. On the billing read date, UCENTRA automatically
obtains meter reads and generates a report of meter read data. The
report containing the utility usage data is manually uploaded to
UMAX. Currently, Billing staff do not perform a reconciliation of the
transfer of customer account information or imported meter reads
between UMAX and UCENTRA, to ensure that the information is
accurate and complete.
The City of Georgetown may
have understated or
overstated meter data and
therefore, have an
understated or overstated
revenue account.
High
The City of Georgetown should implement a process to
monitor the utility data transferred between UCENTRA
and UMAX, to ensure data transfers are complete and
accurate. This can be achieved by reviewing hash totals
for imports or verifying record counts for each file transfer.
Reporting
Management's Response:
Working with vendors to determine best approach in
determining report and assigning role responsibilities.
Responsible Party: Customer Care, Business Systems,
IT
Implementation Date: 2018-19
This risk was somewhat mistated. Meter readings from the MDM system are automatically
uploaded in the UMAX software. Verification of file data is handled in the middleware software
where an error file is produced if the data upload errors. IT advised that the recommendation to
review hash totals for the imports was a project that they have been trying to get time on Rick’s
schedule to work on. Unfortunately he is pretty busy and we have not been able to get to this
one. At this time that item has still not been resolved. That project will roll into this year IT projects
to get completed.
Not Mitigated Not Started IT project plan for
2020-21
Billing and
Invoice,
Usage
Reconciliat
ion
BI-02
The City of Georgetown has a target date to clear all billing errors
within two business days. According to the Customer Care Manager,
there are approximately 500 errors per billing cycle. They are currently
clearing billing errors within three to five business days due to the
back-log of customer care issues since the UMAX implementation.
The City of Georgetown should strive to meet their target of clearing
billing errors within one business day.
The City of Georgetown may
not be recording revenue in
the correct period or have
unbilled revenue.
Moderate
The City of Georgetown should track the errors to
determine the root cause of the issues. This would allow
the errors to be resolved in a systematic manner so the
number of errors can be reduced in total.
Business
Process &
Reporting
Management's Response:
Review business process & develop appropriate
exception reports
Responsible Party: Customer Care, Business Systems,
IT,
Implementation Date: 2018-19
The system and business processes have stabalized since implementation of the software in
August 2018 and Customer Care is consistently meeting this metric 99.6% - 100% of the time -
depending on billing cycle.
Mitigated Complete
Billing and
Invoice,
Usage
Reconciliat
ion
BI-03 The City of Georgetown currently has not established criteria for what
constitutes as a “significant” billing error.
The City of Georgetown may
not address errors consistently
and as a result, have an
understated or overstated
revenue account.
Moderate
The City of Georgetown should develop criteria to
determine which billing errors are significant for the billing
error supervisory review process, including quantitative
and qualitative considerations, to be used consistently by
all Billing supervisory personnel.
Business
Process
Management's Response:
Review and document business process & criteria
Responsible Party: Customer Care
Implementation Date: 2018-19
An approval level for billings errors has been incorporated into the UMAX system and provides an
automated workflow for Review. Billing error adjustments are routed for approvals based on
monetary volues. Billing adjustments are primarily used for water leak adjustments.
Mitigated Complete
Billing and
Invoice,
Usage
Reconciliat
ion
BI-04
The City of Georgetown does not currently have criteria or a
documented policy to limit the number of times estimates can be
used to create an invoice on customer accounts or the number of
consecutive months a customer’s bill can be estimated.
The City of Georgetown may
estimate certain customer
accounts repeatedly and
have an understated or
overstated revenue account.
Moderate
We recommend the City of Georgetown develop and
implement a formal policy with criteria for the number of
times customer accounts can be estimated or the
number of consecutive billing periods before requiring an
on-site meter read.
Business
Process
Management's Response:
Review current practice and incorporate policy into
Ordinance
Responsible Party: Customer Care
Implementation Date: 2018-19
A Policy was developed and implemented whereby metered accounts will not be estimated for
more than 2 consecutive months. (attached)Mitigated Complete Finalizing Policy
Billing and
Invoice,
Usage
Reconciliat
ion
BI-05
The City of Georgetown does not have procedures in place to ensure
that a person, other than the person who corrects billing errors,
reviews the error correction prior to releasing the bill.
The billing errors may not be
appropriately resolved and
will result in an overstated or
understated utility revenue
account.
Moderate
The City of Georgetown should consider creating
separate duties for processing and approving billing error
corrections, prior to the release of the bill.
User Access -
Segregation
of Duties
Management's Response:
Review of UMAX user access to determine
appropriate segregation of duties within current
staffing levels
Responsible Party: Customer Care, Business Systems,
IT
A 2-step validation process for meter reads exists in the Customer Care/Billing work group. The
Billing group corrects the identified billing errors, the billing software then creates the bill, and
another work group reviews the bills prior to release.
Mitigated Complete
Billing and
Invoice,
Usage
Reconciliat
ion
BI-06
The City of Georgetown does not have procedures in place to verify
that all bills are printed and provided to customers. Currently,
customer bills are printed by DataProse two days after the billing
date and sent to customers. After the bills are printed, the Customer
Service Supervisor receives an automated email from Data Prose
containing the total number of printed bills. This total is currently not
being compared to UMAX to ensure accuracy and completeness.
City of Georgetown
customers may not receive
their bills timely, which will
cause an increase in days in
accounts receivable.
Moderate
The City of Georgetown should develop and implement
a formal process to reconcile the customer bills printed
by DataProse to billing information in UMAX.
Reporting
Management's Response:
Develop a reconcilation report between
internal/external systems
Responsible Party: Customer Care, Business Systems,
IT
Implementation Date: 2018-19
Bill information sent to the 3rd party bill print provider (currently Dataprose) is reviewed by the
Manager. Manager also reviewed a monthly report of all Active Utility Contracts to verify that
those contracts have all had billings associated with them during the period.
Mitigated Complete
Billing and
Invoice,
Usage
Reconciliat
ion
BI-07
Utility accounts that are billed on a consolidated basis are only billed
on the latest date of all the utility bills. This could cause the billings for
some utility meters to be delayed into subsequent accounting
periods. This also results in the need for complicated accruals at
period ends to produce accurate financial statements.
The revenue may be
materially understated.High
We recommend the Customer Care Director and
Accounting department work together to estimate the
accrual for unbilled revenue (including consolidated) at
year-end and change the billing cycles to be the same
for consolidated meters. Changing the billing cycles to
be the same for consolidated meters will reduce the
complexity of periodic accruals.
Reporting
Management's Response:
This has been implemented. Year end revenue
accruals provided. Working on moving consolidated
accounts back to individual cycles.
Responsible Party: Customer Care, Vendor
Implementation Date: Reconcilation done -
Consolidate accounts - 2018-19
Consolidated Bill Cycles outside City limits, were removed and the accounts were configured to
bill with the weekly cycle billings based on location. The accrual report was improved, further
standardized, and is reviewed in the executive management Utility Finance Committee (UFC)
meeting on a bi-monthly basis.
Mitigated Complete
Adjustment
s and
Cancellati
ons
AC-01
The City of Georgetown currently reviews all customer account
adjustments on a monthly basis and refunds on a weekly basis, for
appropriateness. However, currently there is no documentation of the
review.
There isn't sufficient evidence
to support the review and the
review may not be performed
timely.
Low
The City of Georgetown should develop and implement
procedures to formally document the review of customer
account adjustments and refunds.
Business
Process
Management's Response:
Review and document business process
Responsible Party: Customer Care
Implementation Date: 2019-20
Practice was documented and a Policy developed (attached). Mitigated Complete Finalizing Policy
end of December
The following points for consideration (PFC) have been identified through our assessment of the in-scope areas and processes at the City of Georgetown. This list is presented for management's review and consideration of items identified through the date of this
communication. Management should consider implementing the recommendations in order to address and mitigate risks surrounding the processes.
Page 1 of 3
Page 58 of 173
City of Georgetown
UMAX Process Evaluation
Points for Consideration (PFC) Matrix
September 2018
Area Ref #Condition Risk or Exposure Risk Rating Recommendation PFC Type Management Response JANUARY 2019 FINAL RESPONSE NOVEMBER 2020 Mitigation Status Status Action Item
The following points for consideration (PFC) have been identified through our assessment of the in-scope areas and processes at the City of Georgetown. This list is presented for management's review and consideration of items identified through the date of this
communication. Management should consider implementing the recommendations in order to address and mitigate risks surrounding the processes.
Adjustment
s and
Cancellati
ons
AC-02
The City of Georgetown does not currently have a system restrictions
to prevent Account Management personnel from reviewing their
data entries related to customer requests for account cancellations.
The City of Georgetown currently has a procedure in place that
requires a different person than the person who prepared a customer
cancellation request, to review the cancellation information in
UMAX. However, the UMAX system does not automatically separate
duties by requiring a different login to review a customer
cancellation request prepared by a different employee. A Customer
Care Representative has the ability to review their own work when
processing and reviewing cancellation requests.
The City of Georgetown may
experience inaccurate
information in the UMAX
system related to customers'
requests for service
cancellation.
Moderate
The City of Georgetown should consider implementing
functionality in UMAX that will restrict Account
Management personnel from reviewing entries performed
by the same user. Alternatively, the City of Georgetown
could assign a second user ID, to be used in times of staff
shortages, for personnel to review their own work
accompanied by a report that is reviewed by UBO
management.
User Access
Management's Response:
Review of UMAX user access to determine
appropriate segregation of duties within current
staffing levels
Responsible Party: Customer Care, Business Systems,
IT
Implementation Date: 2019-20
Customer applications (for initiation and disconnection/cancellation of service (AC-02)) are
accepted on the utility website via an on-line form (Formstack). The application is then
automatically routed to the Account Management workgroup to enter the information into
UMAX. An automated process within the CIS system (via their CSS customer portal) is available
on the more recent CLOUD 365 version of the UMAX software. This enhancement would require
additional funds to implement in our current ONSITE version of the software. This is not a financial
risk - cancelling/disconnecting the account in UMAX autoatically generates a work order to
deactivate the service so monetarily the utility is not negatively affected.
Partially Mitigated Complete
Adjustment
s and
Cancellati
ons
AC-03
The City of Georgetown currently doesn’t have a review process in
place to ensure initial and final meter reads entered into UMAX from
ELSTER are accurate.
The City of Georgetown may
have an over or understated
electric and water revenue
account and accounts
receivable.
Moderate
We recommend the City of Georgetown develop and
implement processes and procedures to formally review
the input of initial and final meter reads entered into
UMAX from ELSTER.
Business
Process
Management's Response:
Review and document business process
Responsible Party: Customer Care
Implementation Date: 2019-20
UMAX software validates the MDM Readings when they are uploaded into the UMAX system base
don criteria specified in the softwares configuration (i.e. average usage, % high, %low)Mitigated Complete
Accountin
g Interface AR-01
The Utility Billing Office edits the file exported from UMAX containing
all daily transaction activity in order to correct errors and upload the
file to INCODE. The Utility Billing Office doesn't have or isn't aware of
an alternate process or procedure to correct the errors in UMAX
instead of the source file.
Data imported into INCODE
may be incorrect or
inadvertently altered.
Moderate
The Utility Billing Office should cease manually editing the
copy of the export file that is saved to the Customer Care
Operations Manager's computer in order to correct errors
and post to INCODE. Additionally, we recommend that
the City of Georgetown work with ITINERIS to learn
procedures and features available in UMAX to correct
errors in the Export File and re-run the nightly batch
process in order to import and post the corrected Export
File to INCODE. Future systems should have an
Integration
Management's Response:
Implemented "no change" policy for file upload. CIS
will be integrated with new ERP
Responsible Party: Customer Care, Finance, Business
Systems, IT
Implementation Date: 2018-19
Practice was documented and a Policy developed (attached). Mitigated Complete Finalizing Policy
Delinquent
Accounts DA-01
The City of Georgetown does not have procedures in place to review
and approve reversals of incorrect late payment fees on customer
accounts. Currently, the Customer Care Operations Manager reviews
the listing of delinquent accounts to identify accounts incorrectly
coded as being delinquent. The late payment fee reversal in the
customer's account in UMAX is also performed by the Customer Care
Operations Manager.
The City of Georgetown may
experience a loss in revenue
from increased late fee
reversals.
Moderate
The City of Georgetown should require a secondary
review of late payment fee reversals in customer
accounts in UMAX.
Businss
Process
Management's Response:
Review and document business process & develop
appropriate reports
Responsible Party: Customer Care
Implementation Date: 2019-20
Practice was documented and a Policy developed (attached). Mitigated Complete Finalizing Policy
Delinquent
Accounts DA-02
The Utility Billing Office only writes off bankrupt and closed accounts
older than one year, which is inconsistent with accounting's
methodology to write off bad debt on all accounts over 180 days.
The City of Georgetown may
have an understated bad
debt expense account and
overstated accounts
receivable account balance.
Moderate
The City of Georgetown should consistently enforce its
policy to write-off accounts older than 180 days, across
all departments. The Accounting department, should
review the write off to ensure consistency and accuracy.
Business
Process -
Budget
Management's Response:
Review and document business process; develop
appropriate reports
Responsible Party: Customer Care, Accounting,
Business Systems, IT
Implementation Date: 2019-20
Customer Care, Finance, Utility Directors are currently working through a plan to provide
adequate funding that adheres to the policy. Partially Mitigated Started
Increased budget
for bad debt write-
off in Water and
Electric to get
closer to what is
needed
Delinquent
Accounts DA-03 The Utility Billing Office is currently limiting the bad debt write-off to
$300,000 per year.
The City of Georgetown may
be understating the bad debt
expense by not recording the
bad debt expense in the
appropriate period.
Moderate
The Utility Billing Office should write off bad debt in
accordance with the City of Georgetown accounting
policy and the Accounting department should be
involved in bad debt estimations and write-offs.
Business
Process -
Budget
Management's Response:
Review and document business process; develop
appropriate reports
Responsible Party: Customer Care, Accounting,
Business Systems, IT
Implementation Date: 2019-20
Customer Care, Finance, Utility Directors are currently working through a plan to provide
adequate funding that adheres to the policy.Partially Mitigated Started
Increased budget
for bad debt write-
off in Water and
Electric to get
closer to what is
needed
Delinquent
Accounts DA-04 The City of Georgetown does not currently perform a reconciliation
of A/R Aging Report to the A/R Sub-Ledger.
The City of Georgetown may
have under or overstated
Utility Account Receivable
accounts.
Moderate
We recommend the City of Georgetown develop and
implement a process to perform a reconciliation of the
Accounts Receivable sub-ledger to the Aging Report.
Reporting
Management's Response:
Review and document business process; develop
appropriate reports
Responsible Party: Customer Care, Accounting,
Business Systems, IT
Implementation Date: 2019-20
An aging report was created and is reviewed in the executive management Utility Finance
Committee (UFC) meeting on a bi-monthly basis. Mitigated Complete
Delinquent
Accounts DA-05
The City of Georgetown methodology for the Allowance for Bad
Debt is 5% of ending Account Receivable-Utility balances after write-
off’s are performed. There is no written documentation to support the
Allowance for Bad Debt methodology and the methodology does
not include a "look back" evaluation to compare the estimate to
historical trends.
The City of Georgetown may
experience inaccurate bad
debt estimates and
inaccurate financial
statement accounts.
Moderate
The City of Georgetown should document the rationale
for calculating the adjustment based upon 5% of the year-
end accounts receivable balance and periodically
update the methodology to ensure estimates align with
historical experience.
Business
Process -
Year End
Management's Response:
Review and document business process; develop
appropriate reports
Responsible Party: Customer Care, Accounting,
Business Systems, IT
Implementation Date: 2019-20
Budget is made on the existing data of bad debt over 180 days.Mitigated Complete Will double check
the FY21 Budget
Payment
Receipts PR-01
The City of Georgetown does not have procedures to reconcile
customer payments received by the City to customer payments
recorded in the UMAX system. Currently, Customer Care
Representative agrees the total number and amount of customer
checks received to check totals included in the payment file which is
imported into UMAX. No reconciliations are currently being
performed for other payment types such as electronic checks, online
payment, auto draft payments, and AVR payments.
The City of Georgetown may
not have a complete record
of payments received in
UMAX.
High
The Customer Care Representatives should develop a
process to compare all payments received to payment
applied in UMAX to ensure all payments were applied to
customer accounts and ensure that all payments were
deposited.
Reporting
Management's Response:
Developing ad hoc reporting tools to assist with
analysis
Responsible Party: Customer Care, Business Systems,
IT
Implementation Date: 2018-19
This reconciliation is automatically done through the deposit Process. Any differences are
flagged as exceptions which are then reviewed and corrected. Customer Care currently does
reconciliations for all payment types as well as reviewing payment totals with the bank deposits
and Mazik.
Mitigated Complete
Page 2 of 3
Page 59 of 173
City of Georgetown
UMAX Process Evaluation
Points for Consideration (PFC) Matrix
September 2018
Area Ref #Condition Risk or Exposure Risk Rating Recommendation PFC Type Management Response JANUARY 2019 FINAL RESPONSE NOVEMBER 2020 Mitigation Status Status Action Item
The following points for consideration (PFC) have been identified through our assessment of the in-scope areas and processes at the City of Georgetown. This list is presented for management's review and consideration of items identified through the date of this
communication. Management should consider implementing the recommendations in order to address and mitigate risks surrounding the processes.
Payment
Receipts PR-02
The City of Georgetown does not currently reverse or "void" incorrect
payments in the MASIK cashiering system. The City of Georgetown
reverses or "voids" payments by reversing the entry directly in the
customer account in UMAX. This results in a difference in payment
information between the MASIK and UMAX systems.
The City of Georgetown may
have incorrect customer
account payments and as a
result, have an under or
overstated revenue account.
Moderate
The City of Georgetown should discontinue the
procedure of reversing void payments directly in
customer accounts in UMAX and enable the negative
payment entry feature in the MASIK cashiering system to
immediately reverse an incorrect or "void" payment as
soon as the transaction occurs. Additionally, the City of
Georgetown should develop procedures for and conduct
daily reviews of negative entries, as part of daily closing
procedures.
Business
Process
Management's Response:
Process modified in UMAX; Supervisors are closing all
cash drawers and reviewing all processed
transactions
Responsible Party: Customer Care
Implementation Date: 2018-19
The "VOID" functionality was removed from the existing Cash Collection module. A
corresponding credit to offset incorrect entries is used to ensure a record of the reversal.Mitigated Complete
Payment
Receipts PR-03
The City of Georgetown does not periodically reconcile the payment
information in MASIK to the payment information in UMAX,
specifically with regard to voided or incorrect payments.
The City of Georgetown may
have incorrect customer
account payments and as a
result, have an under or
overstated revenue and
accounts receivable account
balance.
Low
We recommend the City of Georgetown reconcile
voided payment information in MASIK to voided payment
information in customer accounts in UMAX. These
processes and procedures may involve developing or
using existing reports in the UMAX, MASIK, or BI Reports
systems.
Business
Process
Management's Response:
Developing ad hoc reporting tools to assist with
analysis
Responsible Party: Customer Care, Business Systems,
IT
Implementation Date: 2018-19
Mazik doesn't have voided payments. Rather it allows for Credit Payments which are then taken
into account as part of the Mazik payment reconciliation.Mitigated Complete
Payment
Receipts PR-04
The City of Georgetown does not have procedures in place to
monitor the Unapplied Credits General Ledger account or the aging
of transactions within the account.
The City of Georgetown may
be susceptible to inaccurate
liabilities, be required to
refund money to customers, or
escheat funds to the state.
Moderate
We recommend the Accounting Department implement
procedures to reconcile and review the Unapplied
Credits GL account on a monthly basis.
Reporting
Management's Response:
Developing ad hoc reporting tools to assist with
analysis
Responsible Party: Accounting, Customer Care
Implementation Date: 2018-19
Unapplied credits flow to the GL. Staff can run a report to reconcile and review.Not Mitigated In Progress
LJZ will review
report and
compare to GL
account by the
end of the year.
General GN-01
The City of Georgetown has not developed procedures to document
the process and controls within the key processes reviewed: New
Customer Set Up, Billing & Invoicing, Adjustments Disputes and
Cancellations, Payment Processing, Unapplied Credits, Delinquent
Accounts, Accounts Receivable Write-Offs, Transaction Imports, and
Permit Fee Reconciliation.
The employees may not utilize
the same process and
controls if the process isn't
documented. Additionally,
new employees will not have
complete information on
process and controls when
key personnel leave City
employment.
Low The City of Georgetown should develop procedures and
document controls for each process identified.
Documentati
on
Management's Response:
Working on this as part of the GUS standardized
procedure project
Responsible Party: Customer Care
Implementation Date: 2018-19
Procedures and documented controls were developed and implemented based on existing
practices with the exception of unapplied credits. Mitigated Complete
Page 3 of 3
Page 60 of 173
Make the mark.
CITY OF GEORGETOWN, TEXAS
SEPTEMBER 25, 2018
Citywide Risk Assessment
Results & Next Steps
Page 61 of 173
September 25, 2018
Mr. David Morgan, City Manager
City of Georgetown
113 E. 8th Street
Georgetown, Texas 78627
Dear David,
We have performed the procedures as agreed upon in our consultation agreement dated November
7, 2017. Those procedures were applied solely to provide consulting services to assist City of
Georgetown, Texas (“City”) in developing a Citywide Risk Assessment (CRA) to understand the risk
environment and internal control structure of your functional areas and processes to identify key
risks and the internal controls over those risks.
The results of this report contain our assessment of the key risks to your organization, rankings of
current mitigation strategies, treatment plans to assist in the management of key risks, and emerging
best practices in government industry control environments.
We were not engaged to, and did not perform an examination, the objective of which would be the
expression of an opinion of City of Georgetown, Texas’s internal control environment. Accordingly,
we do not express such an opinion. We were not engaged to perform any specific internal control
testing procedures beyond inquiry of management and, therefore, we have not done so. Had we
performed additional procedures, other matters might have come to our attention that would have
been reported to you.
This report is solely for the information and use of the management of City of Georgetown, Texas
and is not intended to be, and should not be, used by anyone other than the specified party.
We would like to recognize and thank the staff of City of Georgetown, Texas for the cooperation and
courtesy extended to us throughout this process.
Sincerely,
Doug Farmer, CICA
Partner – Risk & Accounting Advisory Services
Plante Moran, PLLC
Page 62 of 173
TOC | Page
Table of Contents
Executive Summary 1
Project Scope and Approach 3
Risk Universe 4
Impact and Likelihood Criteria 5
Risk Assessment Results and Next Steps 7
Appendix A: Risk Treatment Action Plans 11
Appendix B: Information Technology Detail 40
Page 63 of 173
1 | Page
Executive Summary
Purpose and Introduction
In 2017, staff updated the City’s Fiscal and Budgetary Policies to enhance the existing internal audit
and risk program. The General Government and Finance Advisory Board and the Council added
ongoing funding to the Finance Administration budget to support this change. As a first step in
the program, the City procured a firm to perform a comprehensive risk assessment. The outcome
of the assessment will be used to prioritize the steps to continue enhancing the audit program and
mitigating risk.
Plante Moran performed a Citywide Risk Assessment (CRA) of the City of Georgetown, Texas
(“Georgetown”, “COG” or “City”) with the objective of helping the City achieve its strategic
priorities and advance management’s process to identify, classify and mitigate risks to the
organization. Our CRA services consisted of the following:
1. Interview key stakeholders to understand Georgetown’s viewpoint on risk management
2. Conduct interviews with key City Departments to assess inherent and residual risks of
the risk universe
3. Assess the strength of Georgetown’s mitigating activities and risk treatment factors
4. Assignment of risk owners and actions steps for remediation plans, if necessary
5. Preparation of reports to management and Council detailing the results of our work and
recommendations to manage risk and strengthen the control environment
High Level Themes Noted:
• The City is exposed to four high Information Technology
(IT) residual risks. We recognize the City is currently in
process of an ERP system upgrade and the status of
these conditions will change in the near future: IT
Cybersecurity, IT Asset Management: Data Classification,
IT Access Management and IT Contingency Plan. See
Appendix B for IT Risk Report.
• The City lacks a clear process for the assignment and
review of user access roles and responsibilities to achieve
segregation of duties in three key business departments.
We noted during discussions with Finance, Customer
Care and Parks and Recreation one person can control
more than two phases of a transaction exposing the City
to unauthorized transactions and fraud risk.
• The Georgetown Utility Service (GUS) electricity
is a vertically integrated monopoly which is
allowed in the State of Texas. The Texas
Legislature granted an exception called OPT
OUT of bundled services and this gets reviewed
at each legislative session every two years. If this
OPT OUT provision is rescinded, the City would
still have the wires/ transmission equipment and
would be the whole seller to the power
companies but there would be significant effort
and expense to the City to be OPT IN ready if
the legislature changes position and the resulting
transition would take about 2 years.
• Management indicated several potential costly Texas
legislative acts are due for review at future legislative
sessions.
• The City is challenged with documentation of
operating policies and procedures. Currently, 15
out of 25 (60%) departments we interviewed
have a lack of clearly written policies and
procedures available to all employees.
Page 64 of 173
2 | Page
Project Approach and Scope
Approach
We met with management to develop the following:
• Planning Meeting – This segment was dedicated to understanding the risks to key
individuals in the organization. We worked with management to outline the risks
impacting the City.
• Ranking Criteria – Based on our conversations with key individuals, we created impact
and likelihood criteria for grading / assessment of the risks.
• Risk Assessment Interviews - We held risk assessment interviews with key individuals
from key departments across the City to capture management’s view of inherent risks
and mitigating activities.
• Control Gaps & Observations – Using the information gained in the items above, we
noted observations, identified the top residual risks to the organization, and offered
recommendations for control and process improvements.
Scope
In context of this risk assessment, a “Key Business Department (KBD)” is defined as a vital
business process, function or activity on which the organization spends a significant amount of
financial or personnel resources to perform, or an activity over which they have primary
responsibility within the City. The following 25 departments are considered KPD’s and in scope
for this engagement:
Key Business Departments (KBD) Listing
1. (AIR) Airport 14. (GUS) Georgetown Electric / (NRG)
Energy Services
2. (ASV) Animal Services 15. (PLH) Planning/Housing
3. (ATT) City Attorney 16. (HUR) Human Resources
4. (COD) Code Enforcement 17. (BINS) Building Inspection Services
5. (COM) Communications 18. (ITS) Information Technology Services
6. (CRT) Municipal Court 19. (LIB) Library
7. (CUS) Customer Care / Conservation 20. (MGR) City Manager’s Office
8. (CVB) Convention & Visitor's Bureau 21. (PKR) Park & Rec
9. (ECO) Economic Development / Main
Street
22. (SEC) Secretary / Records
10. (ENG) GUS Systems Engineering / GIS 23. (SWR) Solid Waste & Recycling
11. (FIN) Finance, Purchasing & Payroll 24. (TSP) Transportation
12. (GFD) Georgetown Fire Department 25. (WSV) Water Services
13. (GPD) Georgetown Police Department
Plante Moran met with the department heads and key managers to discuss the risk universe,
assess the inherent risks and document the key internal controls and mitigation strategies for
each risk in the risk universe applicable to each department. Residual risk scores are calculated
based on inherent risk minus strength of mitigation activities.
Page 65 of 173
3 | Page
Risk Universe
A planning meeting was held with the City Manager and Assistant City Managers to co-develop a
risk universe using a standard governmental entity risk profile customized to the Georgetown
specifics for population, demographics, services offered, operations and complexity. The initial
universe started with approximately 90 risks and the list was distilled down to the top 33 risks
applicable to the City of Georgetown. We then met with each department individually to discuss
the impact and likelihood to their department. It is important to note that not all 33 risks are
applicable to every department. Only 14 out of 33 risks were determined to be citywide
impacting all departments. The illustration below is the risk universe utilized for this assessment:
City of Georgetown Risk Universe
1. Access to Talent 18. IT Security Awareness, Training and
Education
2. Billing for Citizen Services 19. IT Third Party Roles & Responsibilities
3. Budget and Planning 20. Leadership
4. Composition of Tax Base 21. Legislation
5. Disaster Recovery / Business Continuity 22. Physical Security
6. Emergency Notification System Failure 23. Police Failure
7. Fire Department Failure 24. Records Management
8. Freedom of Information Act (FOIA) 25. Regulatory Filings
9. Fraud 26. Segregation of Duties
10. Grant Obligations 27. State-Fed Regulations
11. Health & Safety 28. Succession Planning
12. IT Access Management 29. Talent Management
13. IT Asset Management: Data Classification 30. Tax
14. IT Contingency Plan 31. Utility Market
15. IT Critical Security Event Identification 32. Utility Outage
16. IT Cybersecurity Governance Model 33. Vendor Reliance
17. IT Incident Response Management
Note: the 14 bold risks were common citywide across all departments. The remaining risks were
assessed on a case-by-case scenario by department. Information Technology risks were evaluated
in three categories: 1) Centrally Managed, 2) Vendor Managed, and 3) Department Managed.
Impact and Likelihood Criteria
Key department personnel participated in the risk interviews to rank the risks to the organization
using an impact and likelihood criteria developed with senior management. The impact and
likelihood criteria table below is applied to each risk to assign the inherent risk. The inherent risk
rankings are then used as the starting point to calculate residual risks.
Impact Criteria
Ranking 5 (high) 4 3 2 1 (low)
Financial Impact:
Expense or Lost
Revenue >$150K $100K - 150K $50K - $100K $25K - $50K <$25K
or Strategic Impact:
Page 66 of 173
4 | Page
Strategy/
Mission/
Legislature
Failure to
meet key
strategic
objective
Major
impact on
strategic
objective
Moderate
impact on
strategy
Minor
impact on
strategy
No impact
on strategy
or Operational Impact:
Reputation Extreme Severe Moderate Low None
Process /
System
Shutdown
> 7 Days 5 - 7 days 3 - 5 days 1 - 3 days < 1 day
Compliance Impact:
Regulatory -
State/ Local/
HIPAA/ Debt
Covenants
Large-scale
material
breach of
regulation
Material
breach but
cannot be
rectified
Material
breach which
can be
readily
rectified
Minimal
breach
which
cannot be
rectified
Minimal
breach
which can
be readily
rectified
Likelihood Criteria
Ranking 5 (high) 4 3 2 1 (low)
Probability of an event occurring in a given year:
>20% 15 - 20% 10 - 15% 5 - 10% <5%
or Event Occurrence (on average):
Once a year or
more 1 in 3 years 1 in 5 years 1 in 7 years 1 in 10 years
Page 67 of 173
5 | Page
Risk Identification and Ratings
It is important to clarify the factors in determining the levels of risk as presented in the following
departmental risk assessment graphs. For comparability purposes, risk is evaluated by distinguishing
between types of risk and the following definitions are provided:
INHERENT RISK – the perceived impact and likelihood associated with a process or activity that exists
simply from the perspective of its current environment BEFORE consideration of mitigating activities
such as insurance, internal controls or other risk treatment strategies. This assumes no significant
actions taken by management to mitigate (address) those risks. For example, the City has inherent risks
associated with its citizen demographics, funding sources, population, economic slowdown, structure of
federal and state government, etc. This can then begin to be refined to the departments within the City
government.
RESIDUAL RISK – the level of impact and likelihood of an adverse event occurring to impede the City,
Department, and/or Processes from achieving success AFTER identifying and testing of management’s
mitigating activities and internal control structure.
The citywide risk assessment considered primarily inherent risks, with limited identification of control
risk as self-reported by management. We did not substantively test specific management controls in
detail and therefore, do not render an opinion on the effectiveness of design nor the efficiency in
implementation or existence. The ratings do not imply a judgment on how management is addressing
risk and thus is not a specific assessment of management performance nor concludes on ‘Residual
Risk’. Management will need to perform detail testing to determine: (1) if mitigation activities reported
by management are actually in place, and (2) if the mitigation activities are designed and operating
effectively.
VELOCITY – the speed assessment of how quickly a risk will impact the organization:
• Fast: These risks are becoming more relevant to Georgetown’s operations and can quickly
impact the organization. Risks with a moderate to high residual risk ranking and fast velocity
should be closely monitored as a risk event could occur quickly and without warning.
• Moderate: No known or pending events suggest either an increase or decrease in the composite
risk weighting. These risks will impact the organization at neither a fast nor a slow pace.
• Slow: These risks will impact the organization over time and might require a playbook that
extends over a longer period of time.
Risk Assessment Results and Next Steps
The following pages summarize the Risk Assessment Results from 3 different perspectives:
Page 68 of 173
6 | Page
Graph 1 - Net Risks by KBD 1:
(1) Net Risks by Key Business Departments: the total number of risks from the Risk Universe that apply
to each department. As noted earlier, 14 of the 33 risks have been identified as pervasive across all
departments and the others are assessed on a case-by-case scenario.
The net risk assessment by KBD revealed that Georgetown Fire Department, Information Technology
Service2, Finance, Georgetown Police Department and Parks & Recreation fall within the high risk
category based on Net Risks by Department.
1 Each department was assessed for the 33 risks outlined in the Risk Universe on p. 3. There are 14 risks
that are pervasive across the City and the remaining risks were assessed on a case-by-case scenario.
2 For the purposes of risk ranking, certain Information Technology risks with similar mitigation
activities and control objectives were combined for reporting purposes. The Risk Universe shows 8 IT
risks and the detail IT Risk Assessment report is included in Appendix B has 11 risks.
Page 69 of 173
7 | Page
Graph 2 – Weighted Residual Risks by KBD:
(2) Weighted Risks by Key Business Departments: the total number of risks weighted by rankings using
the following weighting formula: Red 17 or > (3 points), Yellow 8-16 (2 points), and Green <8 to 5 (1
point), <4 (0 points). Therefore, the higher risk rankings carry a higher weighted risk.
The Weighted Residual Risk by KBD reveals there are two (2) additional departments needing
consideration as the ratio of high risks to total brings the residual risk to a high for Customer Service
and Building Inspection Services, in addition to the KBD’s noted in Graph 1.
Evaluation of these various factors provides indicators on prioritizing the potential Future State Risk
Mitigation Activity recommendations outlined in Appendix A.
Page 70 of 173
8 | Page
Graph 3 – Citywide Composite Residual Risk Rankings
X = Fast Velocity | = Moderate Velocity
(3) City-wide Composite Residual Risk Rankings: the profile of consolidated highest ranking risks to the
City regardless of KBD. As noted earlier, certain risks may only apply to a limited number of KBD and
may be insignificant on a City-wide basis.
Page 71 of 173
9 | Page
Composite scores represent a cross-section view of risk without regard to KBD. The composite scores
above are an average of the risk rankings for only the departments where the risks are applicable. For
example, Billing for Citizen Services is a risk to the City but only applies to 13 out of 25 KBD’s. The
scores above are an average of those applicable departments excluding the departments that do not do
billing. Results from this graph illustrate the severity of risk regardless of the department which they
fall under.
Residual Risk Dispersion
The following graph depicts the dispersion of the risk events between high, medium, and low residual
risk (including the consideration of existing control or mitigation activities) categories. High indicates
that the residual risk score fell beyond Georgetown’s risk tolerance. These risks require the most
attention and strongest mitigation strategies. Medium indicates that the residual risk was within
tolerance. Low indicates that the risk fell well below Georgetown’s tolerance. It may be possible that
some of these risks are being over mitigated.
Next Steps
1. Strengthen and implement mitigating activities for each risk to bring the residual risk down
into tolerance (see Risk Treatment Action Plans in Appendix A).
2. Assign risk owners and control owners and determine what information needs to be reported
back to the City Manager on a periodic basis (i.e., quarterly).
3. Identify a risk management resource to manage the risk owners and communicate all necessary
information from the risk owners to the City Manager and City Council.
4. Risk Owners identify key risk indicators (KRI’s) for each risk.
5. Build execution playbooks for each risk treatment.
RANK RESIDUAL
RISK
COUNT
High > 16 7
Medium 8 – 16 14
Low < 8 12
Total 0 – 25 33
Page 72 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
10 | Page
Recommended Risk Treatment Action Plans
Page 73 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
11 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
1 IT Cybersecurity
Governance Model
A comprehensive
Information
Technology (IT)
cybersecurity policy
and procedures
document has not
been approved by
management and
communicated to
all employees and
relevant external
parties, outlining
responsibility and
oversight for
Information
Security (IS) and
policy
administration.
21.00 IT Director
1) The City has a documented IT Acceptable Use
Policy in place but it does not encompass an
overall Information Security Program (ISP)
containing the following elements:
Purpose/Scope, Roles and responsibilities
(including those related to regulatory
requirements), Enforcement, Information
Sharing, Data Classification, Information Risk
Management (IRM), Data Backup and
Retention, Data Destruction/ Retention Policy
2) Members of the IT department perform several
duties beyond their originally assigned tasks
and roles and responsibilities related to key
initiatives such as Risk & Incident Management,
Disaster Recovery & Business Continuity are
not clearly defined
3) The IT department has taken measures in
implementing security practices throughout the
IS environment; however organizational
cybersecurity risk management practices are
not formalized, and risk is managed in an ad
hoc/reactive manner; a citywide approach to
managing cybersecurity risk has not been
established
1) We recommend the City implement a
governance framework that allows for the proper
management of a successful ISP. An effective ISP
involves participation from senior management
to set the direction for proper information
security practices, adequate staffing and
compliance with policies
2) Further, we recommend the City adopt a
practice of performing a Cybersecurity risk
assessment periodically. The periodic approach
may take either of the following approaches: (A)
performing a full assessment every other year
due to intensive resources required to facilitate
such an exercise or, (B) a targeted approach
done annually including:
• revisiting this report findings and updating
controls where appropriate,
• re-assessing the City’s mitigation plan to
update progress and note any further
concerns, and/or,
• selecting a few high-priority control areas (e.g.
vendor management, or any business
objective/goal identified by executive
management) and re-assessing associated
threats related to those areas
The City is already taking several steps to
comprehensively manage and enhance security:
1) Implementing IT Catalyst Plan – 5 year Strategic
Plan
2) Developing documented policies to address
various IT areas
3) Developing Cybersecurity Training
4) Conducted 2 security audits
5) Budgeting Lead System Security Analyst in FY19
6) Conducting PCI (Payment Card Industry) study
7) Implementing two factor authentication
IT agrees that an Information Security Program
(ISP) needs to be created.
IT Immediate actions
(next 12 months)
1. IT Cybersecurity Risk Assessment by the US
Department of Homeland Security. 2. Determine
best practices, implement security policies, and
identify staffing/challenges to implement ISP. 3.
Identify staffing needs to appropriately manage IT
security challenges and ISP.
IT future planned actions
(12 - 36 months)
1. Continue Cybersecurity scanning on a yearly
basis. 2. Implement ISP. 3. Assign security roles
to existing staff and hire any security staff needed to
manage an Information Security Program
Page 74 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
12 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
2 Utility
Market
Exposure to
fluctuations in the
market price of
utilities.
18.75
Deputy
General
Manager –
Georgetown
Utilities
1) The City has no physical risk and low financial risk
from the power supply market.
2) ERCOT, the state run system operator, manages and
controls the physical matching of supply to demand
statewide, thus eliminating the City’s exposure to
physical supply risk.
3) As a Utility within ERCOT, the City takes delivery of
all power from ERCOT at the market rate, thus
exposing inherent financial risk.
4) The City mitigates the inherent financial risk through
hedging demand with offsetting, fixed-price power
purchase agreements (PPA’s) and hedging
transmission congestion charges through congestion
revenue rights (CRR’s) which are forward contracts
on congestion. Additional residual financial risk is
further mitigated through the industry standard
utility practice of passing the variance though to
customers as a power cost adjustment factor (PCA).
The City does currently use a form of the PCA pass-
through, however it is not the current practice to
adjust this on a monthly basis.
5) The City has a diversified portfolio of PCA’s with
both short and long terms. The two principle
agreements are a 20 year wind and a 25 year solar
contract. Together, these two contracts exceed the
City’s current needs and will accommodate growth.
6) The long duration power agreements at fixed price
provide long term rate stability through a long term
hedge.
7) A utility rate study is in progress, to update the most
recent study from 2012
8) Quarterly financial updates are presented to the GUS
Board and the City Council.
1) Continue to enhance the City’s forecasting tools
and techniques to increase granularity and
improve accuracy.
2) Continue development of a strategy to meet
future peak demand growth with distributed
generation and storage rather than remote
central generation to mitigate exposure to
transmission congestion.
The City will continue its efforts to mitigate
exposure to the utility market:
1) Implementing rate study recommendations
2) Will grow reserves for contingency and market
fluctuations to comply with Fiscal & Budgetary
Policy
3) Will perform rate study every 3 years
4) Providing quarterly reports to GUS board
5) and City Council.
Page 75 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
13 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
3
IT Asset
Management: Data
Classification
The data,
personnel, devices,
systems, and
facilities that enable
the organization to
achieve business
purposes are
identified and
managed consistent
with their relative
importance to
business objectives
and the
organization’s risk
strategy.
17.00 IT Director
1) The City has identified and catalogued its hardware
and software via a tool called Lansweeper. This
approach ties into an overall information flow
enforcement (NIST SP 800-53 Rev. 4 AC-4) which
ensures the confidentiality, integrity, and availability of
critical data when defined and enforced
2) In addition, the City also maintains a manual list of all
inventoried applications/ software
3) An information classification policy does not currently
exist
1) The City should consider classifying data within the
system based on its criticality and / or sensitivity (NIST
SP 800-53 Rev. 4 RA-2). Classification of data will also
help drive the above-mentioned information flow
enforcement and help define the City’s security
architecture
2) We recommend the classification of City data to define
an appropriate set of protection levels and
communication required for special handling
Classifications and associated protective controls
(including encryption for data at rest and data leak
prevention tools) should take into account department
needs for sharing or restricting information and the
associated business impacts if such data were
compromised. Successful data classification in an
organization requires a thorough understanding of
where the organization’s data assets reside and on what
applications/devices they are stored. Handling
procedures should include details regarding the secure
processing, storage, transmission, declassification, and
destruction of data.
The City is currently taking several steps to classify
and protect data:
1) Implementing IT Catalyst Plan – 5 year Strategic
Plan
2) Developing documented policies to address
various IT areas
3) Classification of HR and Finance data during
Enterprise Resource Planning project
4) Payment Card Industry compliance audit
IT sees value in creating a data classification policy
that outlines how the city classifies data for each
system.
IT Immediate actions
(next 12 months)
*Work with new ERP vendor to
develop classification framework for
financial, asset and employee
information.
Create a Data Classification policy.
IT future planned actions
(12 - 36 months)
Classify data in all systems city wide that IT is
responsible for administering.
Page 76 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
14 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
4 IT Access
Management
Access to assets
and associated
facilities is limited
to authorized users,
processes, or
devices, and to
authorized activities
and transactions.
17.00 IT Director
1) New employees and vendors are required to
sign off on the Acceptable Use policy
2) For financial system, Application Administrator
is assigned responsibility of setting permissions
for add/removal of users after approval from
system owners
3) Security administration duties are assigned to
various applications whereby all analysts have a
designated system/application they are assigned
to. Department directors are considered system
owners; the IT department facilitates
requests/approval of application owner for
security access. All IT employees are CJIS
certified
4) Application vendors must be CJIS certified and
CJIS certification is also required in vendor
agreements. It was noted that not all
applications have a formal process of
provisioning and de-provisioning
5) Every building is on its own VLAN and
segregated, DMZs also exist which is separated
by firewalls (in and out). SCADA systems are
also air gapped and do not interact with other
parts of the network
1) A role-based access scheme should be
established to ensure consistent application of
user access rights within the system. Users
should be assigned their base set of access
authorizations based on the concept of “Least
Privilege Necessary” to perform their role or job
function (as defined within their formal job
description). Additional access beyond the
previously established role-based access scheme
should be formally requested, reviewed for
conflicts and approved (NIST SP 800-53 Rev. 4
AC-2). Moreover, Management should consider
integrating access rights with data classification
efforts identified in Appendix B of this report
2) Ensure a process is in place to approve special
access requests and timely de-provision access
upon notification from HR
The City agrees with these recommendations and is
taking the following steps:
1) Implementing IT Catalyst Plan – 5 year Strategic
Plan
2) Implementing 2 factor authentication
3) Implementing consistent role based access to CIS
and ERP system functions through ERP conversion
project
IT agrees that additional process and policy is
needed to enhance IT access control.
IT feels ownership of physical security audits need
to be conducted by the department(s) that maintain
keys to buildings or the system controlling
automated keycard access.
IT Immediate actions
(next 12 months)
Implementation of Enterprise Application Access
Control policy. Leverage new Systems Admin Lead
to identify additional costs and resources to
implement auditing of these changes in the future.
IT future planned actions
(12 - 36 months)
Identify a way to audit Application Access on a
yearly bases. Implement yearly audits for
Application Access.
Page 77 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
15 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
5 IT Contingency
Plan
Loss or inability to
continue business
due to natural
disaster, system
capacity or
performance issues,
interruption in
communication,
loss or corruption
of data, or loss of
critical vendors or
staff members.
17.00 IT Director
1) The City has an extensive data backup strategy
is in place in order to ensure that critical data
for operations are available in the event of an
interruption or incident
2) The current data backup plan has redundancy
built into the datacenter environmental
controls
3) Recovery processes are in place to restore
systems/assets affected by cybersecurity
events. However, CoG is yet to formalize a
BCP/DRP
4) The City has prepared a five year IT Strategic
Plan which includes a plan for implementing
business continuity practices over the next 2-3
years
Plante Moran recommends the City conduct and
formalize:
(1) A Business Impact Analysis (BIA) which
identifies and analyzes mission-critical business
functions, and then quantifies the impact a loss
of those functions would have on the City, and
(2) An information system contingency plan to
mitigate the risk of critical system and service
unavailability. The contingency planning process
should occur after a formal Business Impact
Analysis (BIA) is conducted, in order to
correlate the system with the critical processes
and services provided, and based on that
information, characterize the consequences of a
disruption. Three steps are typically involved in
accomplishing the BIA:
• Determine mission/business processes and
recovery criticality
• Identify resource requirements
• Identify recovery priorities for system
resources
The City will continue with the efforts already
planned to mitigate this risk:
1) Planning and funding fail-over data center
2) Developing and testing protocol to fail-over data
center
IT feels this risk is related to the lack of a City Wide
Business Continuity plan.
IT fully takes responsibility for Disaster Recovery of
IT systems, a city wide BCP is needed to identify the
Business Impact Analysis and criticality of City wide
services to assist with proper implementation of
Disaster Recovery activities
IT Immediate actions
(next 12 months)
Identify how the city wants to address business
continuity city wide. Work with Emergency
Management to look for third party support to
develop a BCP.
Leverage new Lead System Admin to start planning
and identified resources needed to create a DR plan.
IT future planned actions
(12 - 36 months)
Develop consistent DR plan that can co-exist with
city BCP.
Page 78 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
16 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
6 Legislation
Governmental laws
change that impact
the organization by
financial, operating,
strategic or
compliance issues.
16.36
City
Manager’s
Office
1) The City Attorney’s office monitors legislative
sessions for the City as a whole, and
communicates the effects of legislation to
appropriate departments
2) The Electric Department utilizes a third party
engineering firm to monitor potential legislation
that could impact the Department
3) The City has an agreement with an outside
government affairs and advisory firm which
specializes in advising and assisting
municipalities in legislative activities
4) The Transportation Department has developed
a detail plan of response to the effects of the
City passing the 50,000 population threshold,
specifically related to the traffic signal
operation. After the 2020 census, the City will
be responsible for operating all traffic signals in
the City, which is double the number the City
currently operates. A large financial
commitment will be required to operate and
maintain all traffic signals in the City
1) Council and Management should review and
closely monitor the status of annexation plans
for the City. After the 2020 census, the City will
be limited in its ability to perform annexations
due to Williamson County’s population
surpassing 500,000 citizens
2) The City should work with legislators to clarify
the impact of harmful legislation including
revenue caps and limits on debt financing for
infrastructure during the City’s period of high
growth and should stress the removal of local
control restrictions that impact citizens ability to
impart changes in their local community
The City will continue its efforts to monitor state
actions and advocate for what is best for the
organization and community:
1) Implement Council strategies and tactics related
to influence with State government
2) Continue supporting TML efforts
3) Continue working with government affairs and
advisory firm
4) Continue to build relationships with other
governmental agencies
Page 79 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
17 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
7 Segregation of
Duties
The Organization
fails to adequately
segregate roles and
tasks between team
members.
16.43
Finance
Director
1) Each department communicates a personnel
change to HR and IT to add/remove/change a
staff member’s access
2) HR and payroll have segregated rolls for
processing employee payroll and benefit
information. Only Finance has access to process
changes within the payroll module
3) Segregation within the finance department is
maintained by separate individuals processing
payroll and accounts payable
4) Utilities customer cash receipts are handled
through Customer Care front facing staff. Cash
drawers are reconciled and closed on a daily
basis. Bank deposits are prepared by Customer
Care back office operations daily and are
couriered to the bank by Police Officers.
Revenue financial reporting is done by Finance
5) A police officer travels to the cash locations to
provide secure courier service on all bank
deposits
1) An annual review of user access for all staff
members within the City across all programs
managed by IT should be performed
2) Departments that have not had an internal
control review within the past five years should
evaluate the design and effectiveness of their
internal controls
1) Implementing new CIS and ERP systems which requires
thorough review of system segregation controls.
2) Cameras being evaluated for various cash areas
3) Emphasize and explain segregation of duties attributes
during training for new or revised financial policies and
procedures.
4) Parks & Recreation has segregated deposit duties
separate from cashiers.
5) Finance is reviewing the segregation of the vendor
database duties for the new ERP system.
IT feels this risk requires joint ownership with other
departments.
IT already has controls in place for user access to
computer resources and access to applications.
IT Immediate actions
(next 12 months)
Implementation of Enterprise Application Access Control
policy. Train IT employees on the new policy. Enforce
the new policy on new Enterprise systems as they roll out.
Leverage new Lead Admin to identify resources, and costs
associated with reviewing user access for all city computer
resources and applications.
IT future planned actions
(12 - 36 months)
Implement annual reviews/audits of user accounts with
access to computers and enterprise applications.
8 Access to
Talent
Organization lacks
sufficient staffing
levels to carry out
its routine
operations.
11.75
HR Director
1) The growth of the City has resulted in a large
talent pool for many positions within the City,
with some job openings attracting over 300
applicants. Overall, the City gets sufficient
applicants for general open positions
2) The City is in the process of performing an
assessment of retirement eligibility for key
personnel
3) Departments within the City utilize third party
contractors to fill non-key positions on a
temporary basis
1) The City should evaluate positions with
required specialized certifications and
determine whether entry level staff members
can obtain certifications after hire
2) For specialized positions, including, but not
limited to, building inspectors, paving foremen,
and traffic engineers, the City should conduct
an assessment of staffing levels with a 3-year
outlook
3) The Fire Department should develop a plan to
acquire the necessary EMS personnel talent
1) HR and Fire are continuously developing a
recruitment strategy for future station staffing
2) The City currently recruits many positions such
as 911 dispatcher and Electric Linemen Apprentices
in the manner described in mitigating
recommendation #1 and continues to review
options as new vacancies arise.
3) The City works continuously to keep pay and
benefits market competitive and HR staff is
currently working on enhanced recruitment
branding techniques to continue to bring in
excellent talent.
Page 80 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
18 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
9
Emergency
Notification
System Failure
(ENSF)
The City's
Emergency
Notification System
fails to alert citizens
in the event of an
emergency.
13.81
Emergency
Management
Coordinator
1) There is a city-wide emergency notification
system consisting of tornado sirens and
reverse 911 (Code Red) which are tested on a
regular basis. The outdoor warning system is
place to notify citizens to take shelter and is
not intended to be heard in doors
2) The City recently added a position dedicated
to Emergency Planning
3) Incident Action Plans are developed for large
scale community events, such as the Red
Poppy Festival
1) The City should communicate Incident Action
Plans for large scale events to all parties involved
with the event, including the Convention and
Visitors Bureau (CVB)
2) Management should inform all departments of
the operating procedures related to the ENSF
3) The EMC should develop basic and advanced
emergency management training for key
stakeholders in the City (Division Managers) and
conduct table top and/or practical training
exercises that replicate local level emergencies
The City agrees with these mitigating activities
and will prioritize them in the EMC’s work plan
Page 81 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
19 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
10 Fraud
Customer, third
party, or internal
fraud occurs
resulting in a
significant
misappropriation of
assets and/ or
incorrect financial
reporting, or
corruption/
kickback schemes.
13.75
Controller
1) The Finance Department performs a review of a
small number of P-Cards to verify the legitimacy of
the purchases
2) Fixed assets over $5,000 in value are tracked in the
ERP fixed asset module
3) Currently no fraud prevention program is
communicated to all employees with training to
identify and prevent fraud.
4) The Finance team indicated internal controls can be
strengthened around:
• Communication, billing and collection from -
Planning and Housing and GUS Engineering on
construction/ development contracts with
developers and as they have limited visibility on
project status, progress, completion and
timelines of payment due dates. Cannot get My
Permit Now to reconcile to Accounting
• Processing and internal controls around Grant
Administration regarding collections and
subsequent compliance reporting
• Credit Card (P-Cards) payment procedures are
inconsistently applied across City operations
5) The City lacks internal monitoring controls and audit
logs around Master File Maintenance on IT databases
(employee, customer, vendor, etc.)
6) Segregation of duties reduces the chance of fraud
7) The City has a personnel policy related to fraud
8) A fraud hotline is advertised to the City staff, so that
staff can report fraud anonymously. The reports are
collected by an outside firm, who sends information
to representatives in Human Resources, Finance, and
the CMO for investigation. The CMO follows up on
any investigations
9) Purchasing cards have strict limits to ensure the risk
of misuse by a single employee is limited to an
average of $1,000.
1) The Finance Department should perform more
robust reviews of P-Card purchases and
consider utilizing software to perform regular
audits of P-Cards
2) The Finance Department should perform
annual reviews of P-Card users to evaluate
whether the all users actually need P-Cards
3) The City should implement a more extensive
asset tracking program, utilizing fixed asset tags
on assets valued over $1,000 with consideration
of periodic asset audits
4) Vendor Ship-To addresses should be limited to
a “drop down” list consisting only of City
facilities
5) The City should consider developing a fraud
awareness and prevention training program
with active participants across all City
departments
6) All changes to IT databases deemed to be
material should be tracked on an Audit File Log
and reviewed by someone without access to the
databases
1) Asset tracking and vendor shipping will
improve as part of the ERP project.
2) The City has already implemented and
conducted training on grant tracking and
reporting.
3) Staff are currently developing a citywide
fraud awareness and reporting training.
Page 82 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
20 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
11 Health &
Safety
Exposure to
potentially
significant workers'
compensation
liabilities due to the
inability to
maintain
compliance with
applicable health
and safety laws and
regulations.
13.04
HR Director
1) All Public Works and Utility departments have
a robust safety program consisting of monthly
safety training, daily safety summaries, semi-
monthly safety meetings, and detailed safety
policies. Public Works departments also
provide sufficient safety equipment to all
relevant staff members
2) The Fire and Police Departments have a robust
line of safety gear, training, fitness assessments,
inspections, and safety policies
3) All safety incidents are communicated to
Human Resources for review and to work as a
liaison between the department and the
employee
4) The Airport requires all non-airport employees
to be escorted by a staff member with
knowledge of Air Traffic Control
communication
5) Parks and Recreation requires safety
maintenance with swimming pools to ensure
chemicals are in balance
Overall, the City has robust health and safety
procedures and should consider adding the
following:
1) The Library should develop clear
policies and procedures on a course of
action when a customer, employee, or
volunteer is injured at the facility.
2) The City should review the lifeguard policy
for pool facility rentals. The City currently
does not provide a lifeguard for pool
rentals by the Georgetown Independent
School District and does not require GISD
to provide their own lifeguard.
3) Consider adding an Active Shooter
response plan
1)HR and Library will work together to develop
consistent injury procedure
2) The City has met with GISD swim coaches to
brainstorm ways to mitigate lifeguard risk and is
drafting a facility use agreement that outlines the
lifeguard requirements of the City and GISD
3) HR and Police are developing Active Shooter
training for departments
Page 83 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
21 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
12
IT Incident
Response
Management
Response processes
and procedures are
executed and
maintained, to
ensure timely
response to
detected
cybersecurity
events.
12.00 IT Director
1) The City has no formalized or documented
information security incident response
procedure
2) CoG's IT department has an informal
(undocumented/ad-hoc) resolution process to
ensure appropriate steps are taken to respond
to incidents. The process is triggered in the
event of a report/discovery of compromise, loss,
or theft of system data
We recommend the City implement a formal
incident response plan including:
1) Provide a roadmap for implementing its
incident response capability;
2) Describes the structure and organization of
City of Georgetown’s incident response
capability;
3) Provides a high-level approach for how the
incident response capability fits into City of
Georgetown as a whole and the overall Family
of Companies;
4) Meets the unique requirements of City of
Georgetown’s mission, size, structure, and
functions;
5) Defines reportable incidents as well as
requirements and guidelines for external
communications and information sharing (e.g.,
what can be shared with whom, when, and over
what channel);
6) Provides metrics for measuring the incident
response capability within the organization;
7) Defines the resources and management support
needed to effectively maintain and mature an
incident response capability; and
8) Is reviewed and approved by senior
management
IT agrees a formal process and procedures need to
exist to manage cybersecurity incidents
appropriately.
IT Immediate actions
(next 12 months)
Implement Incident response policy. Train IT staff
on procedures to ensure policy is being met.
IT future planned actions
(12 - 36 months)
Document formal incident response plan including
all recommendations by Plante.
13 Utility
Outage
The City is unable
to respond to mass
failures of electrical,
water, or sewage
outages in a timely
manner.
11.89 Utility
Director
1) Control Center has monitoring alarms in the
event of outages
2) Control Center has an outage management
system to diagnose location of fault and provide
area of impact and customer count
3) Response plan is in place for water, wastewater,
and electric system failures.
4) Regular maintenance tracking of all critical
equipment; replacement is made when
showing signs of degrading through testing
1) Maintain equipment useful lives schedule and
proactively monitor components which have
reached their useful lives
2) Perform a vulnerability assessment to judge your
preparedness for handling the increased
likelihood for power outages
Emergency Response Procedures have been
expanded to include establishment of an
Operations Command Center procedure for
emergency response for large scale utility
outages that do not rise to the level of EOC
activation.
Page 84 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
22 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
14
Disaster Recovery
/ Business
Continuity
Planning
Inability of the
organization to
continue key
business processes
during a potential
disaster due to lack
of sufficient
disaster recovery
planning and/or
execution.
11.60
City
Manager’s
Office
1) Most city staff members are able to work
remotely via Virtual Desktop Infrastructure
(VDI)
2) The Public Works Departments conduct
assessments of potentially hazardous situations
(ex: tree trimming to prevent outages during
windstorms)
3) The Fire and Police Departments can
immediately route 911 calls to the Williamson
County 911 center
4) Tabletop disaster recovery simulations are
performed on an annual basis by the
Emergency Management Coordinator in
conjunction with the Fire Department
5) No backup plan in place at Airport if fueling
system or lighting vault fails. This has been
identified as a weakness and accounted for in
the Airport Master Plan to remediate over the
next 5 years.
6) No DR/BCP plan at the Library,
Communications, Convention & Visitor’s
Bureau, Customer Care and Inspection Services
7) Back in 2005, the Municipal Court had a
system crash and were unable to recover
records. They had to recreate 2.5 months of
records and it took about 6 months. The issue
has not been resolved
1) The City has inconsistent DR/BCP across the
organization. Some departments have a robust
plan and others have none. A DR/BCP should be
developed for every City department. Each of
these department-level plans should then be
integrated into a city-wide plan
2) Tabletop disaster recovery simulations should be
performed with all City Departments
1) As the City buys new or upgrades existing
software, we are prioritizing cloud options that
improve security and access
Page 85 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
23 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
15 Billing for Citizen
Services
Citizens are billed
incorrect amounts
or not billed at all
for citizen services.
11.37
Customer
Care
Director
1) Rates and/or fees for Utility Services, Building
Inspection Services, Animal Services, Permits,
Fire, Police and Airport are approved by
Council
2) Parks and Recreation rates are set and
approved by the Parks and Recreation Director
and submitted to the Council annually
3) Customer Care utilizes systems built into the
meter data management (MDM) and customer
information systems (CIS) that apply validation
methodology to detect abnormal consumption
or amount billed. These “exceptions” are
identified in the systems for staff to review and
validate manually (referred to as “Edit Process”)
4) Billing for EMS services is performed by a 3rd
party service and any hardship write downs
require the Fire Chief’s approval
5) Departments handling cash perform daily cash
reconciliations
6) The Municipal Court clerks review all
tickets/citations before being sent to the
recipient
7) The Code Enforcement Department maintains
evidence of violations to be billed, and the
Energy Services Department maintains the
police report as evidence for billing for damages
8) Airport uses a third party appraisal for lease
amounts along with fuel prices set by City
Council
a. The fine schedule for the Municipal Court
citations should be restricted to specific users
b. All invoices should be created in a single system
across the City and remit-to addresses should
be limited by a “drop-down” function consisting
of only addresses the City accepts payments
c. Management should consider a third party
revenue recognition study to validate all sources
of revenue are complete and accurate across
the City operations
d. An outside party, Emergicon, reviews billing for
EMS incidents as there are various rates
depending on citizen’s ability to pay.
Emergicon also collects funds and this helps
reduce the occurrence of billing errors and
improves collections. However, Emergicon also
writes off funds and there is no reconciliation
of EMS revenue to billings. We recommend the
City enhance reconciliation controls around
billing procedures and perform internal audits
of quality control and verification of vendor
compliance.
1) Implementing a new ERP system will include a
thorough review of the Accounts Receivable/Billing
module.
2) Once Emergicon has completed a full fiscal year
of billings and collections, the City can audit and
evaluate the performance and compliance of
Emergicon’s processes and procedures.
Page 86 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
24 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
16 Composition of
Tax Base
Changes in the
balance of
commercial and
residential tax base
result in losses of
revenue from taxes.
10.63
City
Manager’s
Office
1) The City has performed a detailed mapping of
how each square mile of the city will be used
in the future
2) The City Manager’s Office completes regular
fiscal impact models to determine the effects
of commercial vs. residential development
3) The Economic Development Department has
established a comprehensive strategic plan
4) Economic Development relies on demographic
research for talking to prospects regarding
future development. Works closely with the
Planning Department
5) The Fire Department should be involved in all
communications regarding commercial
development in order to ensure the
Department is able to acquire the necessary
equipment to manage emergencies at large
scale commercial properties
6) The Fire Department has increased its staff to
respond to an increase in calls for service.
The rate of EMS calls for service is growing at
double the rate of population
7) The City is updating its Comprehensive Plan
which will include an update to the future
land use plan
8) Planning Dept. promotes and encourages a
varied level of housing products and
commercial tax base per the Comprehensive
Plan.
1) The City should communicate potential
new commercial and residential
development to directly impacted City
departments and evaluate how new
development would affect each directly
impacted department
2) Management should utilize a concentration
strategy that is flexible and supported by
realistic expectations
The City is updating its Comprehensive Plan
through a robust citizen engagement process
during 2018/19. This plan will identify
community standards and goals for growth.
City staff from various departments impacted by
development meet with the City Manager’s
Office on a bi-weekly basis to discuss major
development applications as well as to
collaborate and problem solve on various issues.
17 Grant Obligations
Organization fails
to meet grant
covenant
requirements.
10.55
Controller
1) Grants filings across the City are monitored by
various personnel within the Finance
Department
2) Grant applications require City Council
approval per the City’s Fiscal and Budgetary
Policy
3) Federal and State grants require compliance
filings and, if omitted, could impact future
grant funding, as well as result in audit findings
1) The City should designate a staff member as a
Grant Administrator. This staff member should
be responsible for maintaining a repository of all
grants being applied for, awarded, contact
person, and any required filings associated with
each grant. City should require that all Grants be
managed through the new Grant Administrator
2) A Grant Status Report should be provided on a
periodic basis to the City Manager’s office for
potential budget considerations
The City has completed these recommendations.
The Controller is the Grant Administrator. A
new policy was implemented in the spring and
the status report is presented to Council in the
quarterly financial report.
Page 87 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
25 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
18
IT Third Party
Roles &
Responsibilities
Security roles and
responsibilities are
not established for
all third-party
service providers
and lack clear
contractual
obligations for
service level
agreements and
KPI’s.
10.00 IT Director
1) The City has identified trusted partners with
respect to hardware and hosted applications
2) Roles and responsibilities have been established
but are not formally documented. Within the
workforce, absence of a formal documentation
poses a risk for segregation of duties and with
third parties, accountability may be lacking
3) The contract between City of Georgetown and
the service provider does not specifically outline
the roles and responsibilities related to
Cybersecurity controls handled by each
organization
4) There is no monitoring of external party use of
the system for potential Cybersecurity events
We recommend management take the following
actions:
1) Clearly identify the cybersecurity responsibilities
to be outlined in the contract with the service
provider including roles for identification,
response, and recovery procedures
2) Establish Key performance indicators for third-
party responsibilities including number of events,
data breaches, number of notifications
3) Continuously monitor contract SLA’s and
established key performance indicators
IT has been working to ensure new contracts meet a
higher level of security requirements. For example
the Office 365 contract with Microsoft has advanced
alerting for things like elevation in access privileges
and enhanced reporting to view our security posture
at any time.
IT manages KPI’s for 3rd party contracts through
simple notification of security events that can follow
the city’s Information Security Response plan should
provide adequate documentation for security events.
Incident response risks are being addressed under
Risk # 3 on this document.
IT Immediate actions
(next 12 months)
Continue to monitor all new contracts to ensure
proper cybersecurity language exists.
Require all vendors to use multi factor
authentication to access city resources.
IT future planned actions
(12 - 36 months)
Review older contracts and make notes of where
changes are needed during contract renewals.
Page 88 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
26 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
19 Vendor Reliance
Any termination of,
or adverse change
in, the
Organization's
relationships with
its key suppliers, or
loss of the supplies
in support of one
of the
organization’s key
services.
9.81
Purchasing
Manager
1) The majority of City Departments have multiple
vendors available to supply goods & services
and would not face disruption if they had to
switch vendors
2) We noted 3 departments that have a reliance
on key vendors and they are closely monitoring
this process: Transportation (asphalt and
concrete), Fire Department (specialty vehicle
repair) and Animal Services (specialty
veterinarian drugs and feed)
1) Assign one person the responsibility of
monitoring all key vendors to the City
2) Create a subsidiary listing of all key vendors
with contract details, SLA’s and performance
metrics
3) Report back to City Manager when it is
determined a vendor may become insolvent or
is not meeting SLA’s
4) Prior to contract renewal, negotiate with all key
vendors to capture volume discounts and
preferred pricing
5) Management indicated Garland Power & Light
currently reconciles their meter data to the
scheduling data and the transaction settlement
engine. This could be done in house but would
require additional headcount as the process
runs 24/7. Management should consider a cost/
benefit study to do this in-house
The new ERP will enhance the ability to analyze
vendor and contract details.
The City’s purchasing policy receives quotes
and/or formal bids for purchased over $3,000.
Purchases over $50,000 are approved by
Council so more review is given to these large
expenditures.
The management acknowledges that certain
items noted are “sole source” which provides a
reliance on key vendors in limited
situations/purchases.
Page 89 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
27 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
20
IT Critical Security
Event
Identification
A formal risk event
identification
process is not in
place to identify,
classify and resolve
security events
9.00 IT Director
1) Currently there are a variety of log generation
methods in place for the system, however there
is no catalog of security event types being
identified and reviewed within the logs by
security professionals
2) As noted in the Segregation of Duties risk,
there are no documented audit log reviews of
changes made to critical City databases
1) Identify high risk events that can be alerted
from current logging capabilities (NIST SP 800-
53 Rev. 4 AU-6). Potential high risk events can
be discerned through the risk assessment
process (NIST SP 800-53 Rev. 4 RA-3),
penetration testing, and best practice
documentation. Some common threat events
include:
• Multiple failed login attempts
• Elevations in access privileges
• Changes to application code
• Changes to security settings
• Process specific actions
2) Consider alert generation techniques for risky
events such as devices that connect to the
network without authorization
3) Identified events should be responded to in
accordance with the organization’s Incident
Response Plan
IT does not currently have designated security staff.
This makes it challenging to implement controls at
this level because of the time and knowledge
necessary to keep a proactive approach maintained.
IT agrees we should have an advanced alerting
process on high risk events however continuing to
maintain these types of processes can be staff
intensive.
IT Immediate actions
(next 12 months)
Hire a Lead System Administrator (approved for
FY19) to assist with security activities.
Identify high risk events that occur in current
logging tools. Research methods for alerting based
on events. Research staff time needed to
implement and maintain an alerting process that
always follows best practices. Research managed
security services and costs. Discuss options with
City Manager’s Office for implementation.
IT future planned actions
(12 - 36 months)
Create an alerting strategy/process that alerts staff
when appropriate. Implement alerting for high risk
events.
Implement managed security services if feasible.
Page 90 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
28 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
21
IT Security
Awareness,
Training and
Education
Personnel are not
informed of
potential IT threats
to the organization
and are unable to
respond effectively.
9.00 IT Director
1) The City has implemented an Acceptable Use
Policy amongst other policies around proper
use of computers and accessing digital
information. However, to ensure compliance,
there is a need to assess employee’s
understanding of policies and response to
cybersecurity threats via periodic awareness
and training
2) IT staff monitors and reports email scams to
all employees in an effort to increase
awareness
1) Rely on end users as the first line of defense to
limit exposure to social engineering frauds and
threats
2) Consider increasing complexity of password
requirements
3) Create a formal IT Awareness training and
provide to all employees on a periodic basis
4) Require employees to formally acknowledge in
writing that they have read and understand the
security awareness training, and that they
recognize the ramifications of non-compliance
IT Immediate actions
(next 12 months)
Implement city wide security awareness program
and training.
Partner with HR to leverage use of LMS for security
training.
IT future planned actions
(12 - 36 months)
Continue to provide security awareness training
and review annually for new material and best
practices.
22 Fire Department
Failure
The Fire
Department is not
adequately
equipped to handle
responses to
emergencies in the
City.
8.00 Fire Chief
1) The GFD studies data points to best position
their resources in order to minimize response
times. In instances when there are no
resources available, GFD has agreements with
third party ambulance providers who are
obligated to provide the same response time as
the GFD
2) Also, the GFD have mutual aid agreements with
neighboring communities to assist in calls when
the City is not available
3) The GFD indicated they perform fire
inspections of public buildings (schools,
hospitals, government buildings, etc.) but there
are not enough resources to do fire inspections/
capacity evaluations on all businesses in the
City
4) The City is currently building two stations to
ensure adequate response to the growing
population
1) Consider an independent third party evaluation
study of the GFD capabilities, response metrics
and resource allocations to evaluate if there
needs to be changes to the current resource
allocation model
2) Consider cooperative agreements with ESD8
and/or contiguous municipalities to elevate
synergistic programs (co-located/co-operated)
fire stations and boundary drops (enhanced
auto-aid).
3) Consider making licensed buildings be required
to be inspected annually. Also, consider a self-
inspection program for low risk properties
and/or an inspection matrix as follows:
• Low Risk – every 3 years
• Medium Risk – every 2 years
• High Risk – annually
4) Management should consider the implications for
property owners and businesses when the Public
Protection Classification (PPC) issued by the
Insurance Services Organization (ISO) is not
performed, as there may be a negative impact if not
inspected annually.
GFD regularly reviews KPIs and communicates
with city management on service delivery
standards. Mutual aid agreements are in place
for assistance when additional resources are
needed. Additionally, GFD is exploring
partnership opportunities on a long-term future
station with Round Rock.
A Fire inspector has been added to the staff for
FY19 to help address the backlog of inspections
and keep up with the growing number of
business inspections.
Page 91 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
29 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
23 Physical Security
Facilities are not
appropriately
secured from
unauthorized
access.
9.00 Asst. Parks
& Recreation
Director
Overall the City has robust physical securities
controls in Place:
1) Customer Care and Municipal Courts have
robust physical security programs in place.
Safes are utilized for cash and cameras cover
registers and safes. Dual access controls with
keys and codes are used at cash access points
2) Most City buildings require access badge/ fob
to enter restricted (non-public) areas.
3) Police, Fire and Energy Services departments
have restricted access areas
4) However, we noted several areas with limited
physical security controls:
• Animal Services – lack of physical
security is a major issue as animals have
been stolen. Cash is not well controlled
and cameras are not in place on critical
areas. The safe is not adequately secured.
• Building Inspection Services, Public
Works, GIS, Systems Engineering and the
Georgetown Municipal Complex have
poor physical security
1) Consider taking inventory of all key cards to
validate none have been stolen or lost
2) Consider development of physical security
training for all personnel regarding
safeguarding of assets, restrictive access to high
risk areas, etc. The City must support integrity
of physical security through the organization
with the assistance of the City’s Risk Manager
3) Standardize a consistent security plan across all
locations appropriate for each facility
4) The City currently monitors physical access to
the facility where IT resides to detect and
respond to physical security incidents. However,
CoG does not review physical access logs
periodically
1) Cameras are being evaluated for various cash
areas
2) Security access will be part of the current
facilities study
3) Security access will be evaluated with the
opening of each new or renovated facility.
24
Freedom of
Information Act
(FOIA)
Non-compliance
with FOIA requests 6.22 City
Secretary
1) The procedure is for all FOIA requests to enter
through Legal. They will decipher the request
and handoff to the City Secretary office to
obtain information.
2) FOIA request process is currently being
transferred from Legal to City Secretary and is
approximately 90% complete
3) GovQA is an electronic system used to maintain
and track FOIA requests.
1) When the transfer of FOIA request process is
complete, consider documenting the process
with written policies and procedures
2)
1) The City has completed the transfer of FOIA
request process to the Open Records Coordinator in
the City Secretary’s office.
2) Citywide training has been completed by the
Open Records Coordinator to provide guidelines and
consistency to the process.
3) The City Secretary Department is in the process
of completing Policies and Procedures for FOIA and
should have completed within the next month.
Page 92 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
30 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
25 Police Failure
The Police
Department is
inadequately
equipped to
respond to
emergencies or
responds in an
unauthorized
manner.
6.00 Police Chief
1) Police department is aware of people, process,
technology and regulatory requirements
2) Robust controls are in place to monitor
progress and key performance indicators
3) A culture of clearly communicating
expectations, behaviors, and training is in place
so officers are held accountable for their actions
3) Guardian Tracking is a day-to-day tracking of
personnel performance entry recordkeeping.
Police management reviews and a conversation
with the employees occurs when they handle
situations incorrectly
4) Training includes the following:
• Handling of persons with mental illness
• Defusing techniques to encourage peaceful
tactics
• Non-lethal methods of restraint
5) Internal affairs division investigates all
complaints against officers
1) Develop the following Key Risk Indicators (KRI’s)
and monitoring controls which may indicate a
risk event is about to occur
a. Increase in City crime rates
b. Increase in police misconduct/brutality
incident claims
c. Increase in squad car accidents
d. Excessive overtime
e. Unexpected cost overruns/continuous
unfavorable budget variances
f. Increase in dismissed cases due to insufficient
evidence, improper procedures or failure to
follow legal standards for police
1) The City will monitor quality of life crimes
within the city and identify strategies for
reduction where feasible.
2) The City will monitor and investigate all
complaints, including use of force and pursuits
and will identify strategies for reduction where
feasible.
3) The City will monitor police overtime and
identify strategies for reduction where feasible.
4) An annual report of crime statistics is
presented publically to the City Council.
26 Talent
Management
Organization lacks
a clear assessment
and evaluation
process to align
qualified employees
with specific
business
requirements and
needs.
5.42 HR Director
1) The City personnel policy requires bi-monthly
performance discussions with all employees
2) Formal annual and mid-year performance
evaluations, including employee development
and training plans, are performed on all
employees
3) Energy Department has a robust training
curriculum with a 4-year apprentice program
4) Police department uses Guardian Tracking to
evaluate officer performance daily
1) Have HR department work collaboratively with
business lines to gain in depth knowledge of
resource needs and constraints
2) Consider using an outside party for diversity in
pre-hire assessments
1) HR staff is developing a supervisor survey
to identify employee development for current
and future roles
2) HR staff trained all supervisors in 2017 on
proper hiring techniques including ways to
overcome various forms of hiring bias
3) The city conducted an employee survey in
2016 and again in 2018. 79% of employees
believe their job makes good use of their skills
and abilities. 84% believe their job provides
opportunities to do challenging and interesting
work.
27 Records
Management
No records
management policy
is in place, adhered
to, or is
inadequately
designed.
5.27
Records
Program
Manager
1) The City’s records retention policy is in line
with the Texas State Library records retention
policy. The department receives alerts from the
state library of any changes to policy
2) Finance indicated they are unclear on how
electronic records storage should be handled
3) Parks and Recreation has a large quantity of
waivers and registration hard copy forms
4) Animal Services has a lack of electronic records
and believes there is a risk of information loss
1) Formalize Records Management policy
regarding digital records and communicate to
all departments
2) Consider additional training on electronic
records management
3) Consider digitizing Parks & Recreation forms
1) The Records Team is training various
departments on retention, destruction of records
and digitalization of records.
2) Policies and Procedures have been completed and
implemented.
3) The following information has been made
available to employees via the internal GO site:
a. Records Management Policy & Procedures
b. Retention Schedules
c. Off-site storage information
d. Destruction authorization forms
Page 93 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
31 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
28 Regulatory Filings
Failure to comply
with regulatory
filings such as
GASB, EPA, etc.
5.20 Controller
1) Water Services completes Environmental Protection
Agency (EPA) and Texas Commission on
Environmental Quality (TCEQ) permit reports every
3-5 years
2) Finance prepares annual CAFR and SEFA which is
submitted to the clearinghouse
3) Customer Care prepares annual filings on storm
water use survey breaking out how much water was
taken in to the system.
4) City of Georgetown has an exemption from
complying and filing necessary reports mandated by
Senate Bill 898 (reducing energy consumption in
City owned facilities) & administered via the State
Energy Conservation Offices (SECO) because of the
100% renewable designation.
5) Customer Care is required by TCEQ to report water
quality testing results to customers on an annual
basis. Deadline for customer communications is 7/1.
GUS must certify with TCEQ by 5/1 that we provided
water quality testing results to water purveyors that
obtain wholesale water from GUS.
6) Energy Services relies on outsource provider Snyder
Engineering for all regulatory findings
7) Utility services is subject to an annual requirement
with the ERCOT to validate that a risk management
plan is in place
8) Airport has a significant amount of regulatory filings
ranging from EPA, TCEQ, Stormwater, Airplane
inventory, and Property Taxes through MCAT. Use
Microsoft Outlook as reminders
9) Fire Dept. has numerous state health services filings
regarding training, certifications, incidents, fatalities,
etc.
1) There is a significant amount of regulatory
filings across the City. Management should
consider a consolidated Regulatory Compliance
Landscape (RCL) ledger be compiled to have
one list of all requirements outlining the filing
dates. Further, Management should store this
on a shared drive and assign all filings to an
owner who is required to indicate when the
filing is complete. Someone should be
responsible for checking for missed filings
Management is evaluating a contracts
management system to track and comply with
contractual and regulatory requirements. This
may be part of the ERP implementation or a
stand-alone system.
Page 94 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
32 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
29 Succession
Planning
Leadership talent
within the
organization is
insufficiently
developed to
provide for orderly
succession in the
future.
4.39 HR Director
1) No formal succession planning in place. Per
Human Resources, they emphasize internal
cross training to grow future leaders from
inside the City organization
2) The City is in the process of performing an
assessment of retirement eligibility for key
personnel
1) The City should consider an outside party to
implement a formal Succession Plan
2) Consider a mentor shadowing program to
protect the City against unplanned terminations
or leaves of absences
1) City initiated first Emerging Leader
training program in 2018 with 20 graduates.
Anticipate annual opportunity to grow
employees at various levels each year
2) Supervisory Series initiated in 2017 and
successfully completed by 168 supervisors.
Additional curriculum to be added this year
aimed at growing managerial skillset of all city
supervisors
3) The city conducted an employee survey in
2016 and again in 2018. 76% of employees plan
to continue working for Georgetown for 5+
years, which is significantly higher than most
employers.
30 Budget and
Planning
Budgets and
business plans are
not realistic, based
on appropriate
assumptions, based
on cost drivers and
performance
measures, accepted
by key managers, or
useful or used as a
monitoring tool.
3.24 Finance
Director
1) The City uses a robust budget and planning
tool across the organization using historical
data supplemented with forward looking
analytics. Each Department head formalizes
their budget and forward to Finance for
consolidation
2) Finance utilizes Excel to manually consolidate
the budgets and upload into the ERP system
3) Final budgets are presented to City Council
for review and approval
4) Quarterly budget to actual reports are
presented to City Council
1) Certain departments such as utilities, water,
electric, etc. count on supplemental data to
prepare their budget (see Data Governance risk
#27). We recommend management validate and
document the completeness and accuracy of
assumptions for all budget line items
2) Management should set a clearly defined
threshold for all material variances to be
explained (e.g. +/-XX% and $YY,YYY)
1) The new ERP system will facilitate a
central location of budget development
information and reporting
2) Finance Administration’s performance
measures include budget to actual variance
targets
31 Tax
Non-compliance
with state or
federal tax law.
3.00 Controller
1) Finance maintains schedule of tax payments and
receipts to/ from County, State and Federal
authorities
1) Consider the creation of a master tax filing
schedule and reporting to City Manager
The City agrees with this recommendation.
32 State / Federal
Regulations
Failure to comply
with new or
existing federal or
state regulations.
2.44 Controller
1) Building Inspection Services provided that
maintaining state licenses and Continuing
Professional Education (CPE) is a challenge
2) State regulations require the Police Department
to report all racial profiling and crime data
3) Parks and Recreation indicated that there is a
State Health and Safety Code that requires
public play equipment comply with the
American Society for Testing Materials (ASTM)
F1487-07 which provides performance
standards for public playgrounds and this is
NOT being done on a routine basis
1) Develop a Citywide license and CPE tracking
system
2) Develop a process to ensure all City
playgrounds comply with ASTM F1487-07. The
code does not require a formal inspections
process, just that the City complies with the
ASTM F1487-07 standard
The City will review a tracking system in
context of all other technology needs.
Employees and supervisors will continue to be
responsible for tracking individual and
departmental CPE and licensing.
Parks Department is working on a schedule to
evaluate older parks to replace equipment as
needed. Newer parks and equipment is
compliant.
Page 95 of 173
APPENDIX A – RISK TREATMENT ACTION PLANS
33 | Page
# Risk Risk
Detail
Residual Risk
Score
Risk
Owner
Current State
Mitigating Activities
Future State
Mitigating Activities
Management
Response
33 Leadership
The people
responsible for the
important City
processes do not or
cannot provide the
leadership, vision,
and support
necessary to help
employees be
effective and
successful in their
jobs.
2.42 City
Manager
1) All departments we interviewed provided the
same issue on leadership – there is a strong
management base that sets realistic strategic
objectives and has an open communication line
with each department head
2) Leadership has frequent meetings with
department heads to check on status of
operations and those concepts are clearly
communicated throughout the organization
3) Detail performance evaluations are done at all
levels of the City government and each
employee is evaluated for job performance
1) The City should consider an upward feedback
program to validate lower levels of employees
are satisfied with management’s performance
1) A 360 evaluation process was implemented
last year for Directors and will be rolled out to
mid-level management in the upcoming year.
2) The city has implemented a bi-monthly check-
in program where employees have the
capability to provide upward feedback to their
supervisor.
3) The city conducted an employee survey in
2016 and again in 2018. Employee response
rates were 85% and 82% respectively and the
city has involved employees in tactical action
planning to further improvement engagement
and enablement.
Page 96 of 173
APPENDIX B
Information Technology Executive Summary
Appendix B
Page 97 of 173
APPENDIX B
CYBERSECURITY RISK ASSESSMENT EXECUTIVE SUMMARY
Inherent Risk: Risk management is the ongoing process of identifying,
assessing, and responding to risk. To manage risk, organizations should
understand the probability that a threat event will occur and the resulting
impact. The probability and impact analysis leads to identification of inherent
risk (i.e., risk without consideration of controls) to the IT environment. With
this information, organizations can determine the acceptable level of risk for
delivery of services and can express this as their risk tolerance.
Factors considered when performing the risk assessment are:
• Probability: What is the likelihood that a threat will occur?
• Impacts: What are the immediate damages if the threat is realized (e.g., disclosure of information,
modification of data, disruption of key systems/processes, containment, and resolution costs)?
• Identify Information Assets: What should be protected in relation to electronic data, IT applications and
IT infrastructure? Our methodology takes into consideration any third parties or vendors that transmit,
host, or process your organization’s data or IT systems.
• Criticality Analysis: How critical are your information assets? Each technology layer (i.e., data,
applications, and infrastructure) has its own unique criticality analysis.
• Threats: Identify the natural to man-made threats that impact the confidentiality, availability, and integrity of
your data and information systems.
• Consequences: What are the long-term effects of the threat being realized (e.g., damage to reputation of
your organization, loss of business or revenue, damage to your brand)?
• Controls: What effective security measures (security services and mechanisms) are needed to protect the
assets?
In understanding the high risk areas for the IT applications and systems, several key questions came to mind when
addressing the Cybersecurity considerations:
• What security controls are needed to satisfy the security requirements and to adequately mitigate risk
incurred by using information and information systems in the execution of organizational missions and
business functions?
• Have the security controls been implemented, or is there an implementation plan in place?
• What is the desired or required level of assurance that the selected security controls, as implemented, are
effective in their application?
The answers to these questions are not uniquely answered in isolation but rather in the context of an overall
effective risk management process suggested by the NIST Cybersecurity Framework. Through the control evaluation
process, we isolated areas that City of Georgetown can continue to identify, mitigate, and monitor risks associated
with cyber threats identified through the threat assessment. Logically, areas of high risk would require more
extensive controls than low risk areas and in most cases, inherent risks can be controlled by the implementation of
adequate countermeasures.
Page 98 of 173
APPENDIX B
NIST Cybersecurity Framework Maturity Summary
The chart below indicates City of Georgetown’s overall picture of the current state versus it’s desired/target state in
accordance with the Cybersecurity framework.
Page 99 of 173
APPENDIX B
Mitigation Plan
Page 100 of 173
APPENDIX B
3.1 FINDINGS AND RECOMMENDATIONS
3.1.1 Cybersecurity Governance Model
Assigned to: City of Georgetown
Priority High
Recommendations
Currently, the City’s Information Technology department has no succession plan for key
roles occupied by experienced staff. In addition, most members of the IT department
perform several duties beyond their originally assigned tasks and roles and responsibilities
related to key initiatives such as Risk & Incident Management, Disaster Recovery &
Business Continuity are not clearly defined.
According to Inform ation Security Governance Guidance for Boards of Directors and
Executive Management, 2nd edition, the five basic outcomes of information security
governance include:
1. Strategic alignment of information security with business strategy to support
organizational objectives
2. Risk management by executing appropriate measures to manage and mitigate risks
and reduce potential impacts on information resources to an acceptable level
3. Resource management by utilizing information security knowledge and infrastructure
efficiently and effectively
4. Performance measurement by measuring, monitoring and reporting information
security governance metrics to ensure that organizational objectives are achieved
5. Value delivery by optimizing information security investments in support of
organizational objectives
At a minimum, we recommend the City implement a governance framework that allows for
the proper management of a successful Information Security program (ISP). An effective
ISP involves participation from senior management to set the direction for proper
information security practices, adequate staffing (with assigned roles and responsibilities)
and compliance with policies. Furthermore, a commitment from management helps to
ensure support and funding from for security activities requiring financial resources; and that
organization-wide risk management programs are developed and implemented effectively.
Source: http://www.isaca.org/Knowledge-
Center/Research/ResearchDeliverables/Pages/Information-Security-Governance-Guidance-
for-Boards-of-Directors-and-Executive-Management-2nd-Edition.aspx
Page 101 of 173
APPENDIX B
3.1.2 Risk Management
Assigned to: City of Georgetown
Priority High
Recommendations
At the City of Georgetown, it is evident that the IT department has taken measures in
implementing security practices throughout the IS environment; however organizational
cybersecurity risk management practices are not formalized, and risk is managed in an ad
hoc/reactive manner; an organization-wide approach to managing cybersecurity risk has
not been established. As a result, security activities or business strategies may not be
directly aligned with organizational risk objectives or the current threat landscape.
The City has undertaken an effort through this assessment to evaluate the security controls
needed to combat cybersecurity risks, but there is a need for an overall information
security risk assessment to identify risks to the organization and threat mitigation
strategies.
To this effect, we recommend that management adopt a practice of performing a risk
assessment periodically. The periodic approach may take either of the following
approaches: (A) performing a full assessment every other year due to intensive resources
required to facilitate such an exercise or, (B) a targeted approach done annually. The
targeted approach may include:
(1) revisiting Plante Moran’s deliverables and updating controls where appropriate,
(2) re-assessing the City’s mitigation plan to update progress and note any further
concerns, and/or
(3) Selecting a few high-priority control areas (e.g. vendor management, or any business
objective/goal identified by executive management) and re-assessing associated threats
related to those areas.
Irrespective of the approach selected, the process for performing a risk assessment
typically includes:
• Identification of information assets (data, applications, infrastructure, and vendors)
• Assigning value to identified assets based on criticality (or dollar value in some
cases)
• Evaluation of vulnerabilities and threats
In addition to the above, we also suggest that the City assess the penalties and impact of
security breaches. From a regulatory perspective, such liabilities should be considered to
ensure that risks to sensitive data is properly assessed and accounted for.
Moreover assessing information security risks throughout the organization provides keen
insight into management’s risk tolerance for implementing security layers within the
organization. The IT risk assessment should be in-line with the City's risk management
strategies for identifying risks, evaluating existing controls and mitigating controls,
understanding residual risk and establishing a risk mitigation plan.
Page 102 of 173
APPENDIX B
3.1.3 Policies and Procedures
Assigned to: City of Georgetown
Priority High
Recommendations
Security policies and procedures are key components of an Information Security Program.
They reflect the organization's business processes and strategy, thereby enabling
management to define the scope of security, what is expected from employees, dictate
what must be protected and to what extent, and what the consequences of noncompliance
will be. To this effect, in addition to the already existing Acceptable Use policy in place, we
recommend management consider an organization-wide Information Security Policy, to
include key sections such as the ones listed below:
• Purpose/Scope
• Roles and responsibilities (including those related to regulatory requirements)
• Management commitment and business owner requirements
• Enforcement
• Information Sharing: Define and set requirements for relationships with or
connections to information systems of other agencies.
Additional policies that the City should consider adding include:
• Data Classification
• Information Risk Management (IRM)
• User Access Provisioning and Review
• Data Backup and Retention
• Data Destruction/Retention Policy
• Media Handling/Disposal Policy (this can be combined with the existing Computer
Disposal Policy)
• Data Protection and Encryption
• Secure Configuration/Hardening
• Physical Security Policy
• Contingency Plan
• Vulnerability Assessment and Remediation
• Incident Response Policy (for breaches, events and other critical incidents)
The ISP should be reviewed periodically (e.g. annually) by senior management and
enforced through annual end-user acknowledgement signoffs.
Page 103 of 173
APPENDIX B
3.1.4 Asset Management: Data Classification
Assigned to: City of Georgetown
Priority High
Recommendations
The City has identified and catalogued its hardware and software via a tool called
Lansweeper. This approach ties into an overall information flow enforcement (NIST SP
800-53 Rev. 4 AC-4) which ensures the confidentiality, integrity, and availability of critical
data when defined and enforced.
The next step is to classify data within the system based on its criticality and / or sensitivity
(NIST SP 800-53 Rev. 4 RA-2). Classification of data will also help drive the above-
mentioned information flow enforcement and help define the City’s security architecture.
Most organizations conduct the security categorization process as an organization-wide
activity with the involvement of chief information officers, senior information security
officers, information system owners, mission/business owners, and information
owners/stewards.
Plante Moran recommends the classification of City data to define an appropriate set of
protection levels and communication required for special handling. Classifications and
associated protective controls (including encryption for data at rest and data leak
prevention tools) should take into account department needs for sharing or restricting
information and the associated business impacts if such data were compromised.
Successful data classification in an organization requires a thorough understanding of
where the organization’s data assets reside and on what applications/devices they are
stored. Handling procedures should include details regarding the secure processing,
storage, transmission, declassification, and destruction of data.
Page 104 of 173
APPENDIX B
3.1.5 Access Management
Assigned to: City of Georgetown
Priority High
Recommendations
Logical Access: Access provisioning to the system is completed on the practice of
mirroring, that is, 'set up as another user within the system’. This practice can potentially
lead to excessive access rights being provided to users. On the other hand, for existing
users, additional access is provisioned without a formal review for SoD (Segregation of
Duties) conflict. When users are terminated, access removal from all necessary applications
may not be performed in a timely manner due to delayed notification from HR to the IT
department. Furthermore, in all aforementioned scenarios (access provisioning, modification
and termination), it was noted that not all applications have a formal process of provisioning
and de-provisioning.
A role-based access scheme should be established to ensure consistent application of user
access rights within the system. Users should be assigned their base set of access
authorizations based on the concept of “Least Privilege Necessary” to perform their role or
job function (as defined within their formal job description). Additional access beyond the
previously established role-based access scheme should be formally requested, reviewed
for conflicts and approved (NIST SP 800-53 Rev. 4 AC-2). Moreover, Management should
consider integrating access rights with data classification efforts identified in the findings
within this report (See 3.1.4 above, for more details).
Physical Security: The City currently monitors physical access to the facility where
information system resides to detect and respond to physical security incidents. However,
CoG does not review physical access logs periodically (e.g. quarterly/annually).
We recommend management take the following actions:
1. Establish a role based access scheme that takes into account the job
responsibilities associated with each role for City of Georgetown.
2. Establish a process to periodically review user access (including physical access) to
ensure accuracy and adherence to existing/changed business processes.
3. Ensure a process is in place to approve additional or special access requests and
timely de-provision access upon notification from HR.
4. Implement and enforce procedures to identify and document appropriate access
requirements for removing, adding or modifying City personnel’s access to
electronic PHI. The need for and extent of access should be based on an
assessment of risk, cost, benefit and feasibility as well as business need, and
permission to view, alter, retrieve and store ePHI.
5. Perform a periodic review of user access to PHI and ePHI (including access to the
data center) to verify the list is accurate and to ensure access is still commensurate
with job responsibilities.
Page 105 of 173
APPENDIX B
3.1.6 Contingency Plan
Assigned to: City of Georgetown
Priority High
Recommendations
In order to ensure that critical operations are available in the event of an interruption or
incident, redundancy is built into the datacenter environmental controls at the City and an
extensive data backup strategy is in place. However, a formal contingency plan is not in
place and related resources/systems are not catalogued and prioritized.
Plante Moran recommends the City conduct and formalize:
(1) a Business Impact Analysis (BIA) which identifies and analyzes mission-critical business
functions, and then quantifies the impact a loss of those functions would have on the City,
and
(2) An information system contingency plan to mitigate the risk of critical system and service
unavailability. The contingency planning process should occur after a formal Business
Impact Analysis (BIA) is conducted, in order to correlate the system with the critical
processes and services provided, and based on that information, characterize the
consequences of a disruption. Three steps are typically involved in accomplishing the BIA:
• Determine mission/business processes and recovery criticality
• Identify resource requirements
• Identify recovery priorities for system resources
The information system contingency plan should consider three phases:
(1) Activation and Notification Phase which outlines activation criteria and notification
procedures,
(2) Recovery Phase which outlines recovery activities, escalation, and notification, and
(3) Reconstitution Phase which allows validating successful recovery and deactivation of the
plan through activities such as validation testing, notifications, and event documentation.
The contingency planning process should also include the following elements:
• Roles and responsibilities
• Scope as applies to common platform types and organization functions (i.e.,
telecommunications, legal, media relations)
• Resource requirements
• Training requirements
• Exercise and testing schedules
• Plan maintenance schedule, and
• Minimum frequency of backups and storage of backup media
Further, an effective contingency plan should tie into the City’s Incident Response Plan and
should consider City’s personnel as information system contingency plans are not executed
on their own and an incident will often impact individuals that are crucial to tasks related to
information system operations. Personnel safety and evacuation, personnel health,
personnel welfare, relationships with response organizations, and communication planning
should be considered when developing the contingency plan. Finally, the agreed upon plan
should be compatible with the enterprise-wide Business Continuity Plan.
Sources: http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-
Nov11-2010.pdf
Page 106 of 173
APPENDIX B
3.1.7 Incident Response Management
Assigned to: City of Georgetown
Priority High
Recommendations
Based on inquiry, it was noted that the City of Georgetown does not have a formal Incident
Response Plan. Incident management includes a proactive and reactive phase. While
reactive measures help to ensure that incidents are properly handled, proactive measures
allow incidents to be detected in a timely and controllable manner (See finding 3.1.9). An
improved approach will be to implement an Incident Management Program, which is
initiated by an Incident Response Policy and include the following key elements:
• Provide a roadmap for implementing its incident response capability;
• Describes the structure and organization of City of Georgetown’s incident response
capability;
• Provides a high-level approach for how the incident response capability fits into City
of Georgetown as a whole and the overall Family of Companies;
• Meets the unique requirements of City of Georgetown’s mission, size, structure, and
functions;
• Defines reportable incidents as well as ;
• Requirements and guidelines for external communications and information sharing
(e.g., what can be shared with whom, when, and over what channel)
• Provides metrics for measuring the incident response capability within the
organization;
• Defines the resources and management support needed to effectively maintain and
mature an incident response capability; and
• Is reviewed and approved by senior management
We recommend management take the following actions:
1. Develop a more comprehensive plan incorporating the above elements.
2. Integrate City of Georgetown’s Incident Response Plan testing activities with
relevant third parties.
Page 107 of 173
APPENDIX B
3.1.8 Third Party Cybersecurity Roles &
Responsibilities
Assigned to: City of Georgetown
Priority High
Recommendations
While the City has identified trusted partners with respect to hardware and hosted
applications. We noted the following deficiencies related to third party roles and
responsibilities:
• The contract between City of Georgetown and the service provider does not
specifically outline the roles and responsibilities related to Cybersecurity controls
handled by each organization.
• There is no monitoring of external party use of the system for potential
Cybersecurity events.
Security roles and responsibilities should be established for all third-party service providers
(NIST SP 800-53 Rev. 4 PS-7). Responsibilities are key to ensure that the City of
Georgetown and its service providers understand exactly who is responsible for which
Cybersecurity controls; this is especially important in a business continuity situation. These
roles and responsibilities should be formally documented in a contractual agreement.
Service level agreements should be established based on Key Performance Indicators (KPI)
where City of Georgetown’s expectations are set for each outsourced responsibility to its
third-party service providers. Once established, KPIs should be monitored to ensure third-
party service providers adhere to contractual obligations (NIST SP 800-53 Rev. 4 CA-7).
Furthermore, adherence to Key Performance Indicators should be used to identify potential
issues with vendor service that can be addressed through negotiations or seeking a new
vendor.
We recommend management take the following actions:
1. Clearly identify the cybersecurity responsibilities to be outlined in the contract with
the service provider including roles for identification, response, and recovery
procedures.
2. Establish Key performance indicators for third-party responsibilities including
number of events, data breaches, number of notifications.
3. Continuously monitor established key performance indicators.
Page 108 of 173
APPENDIX B
3.1.9 Critical Security Event Identification
Assigned to: City of Georgetown
Priority Medium
Recommendations
We noted a variety of log generation methods are in place for the system. These logs can
be used to identify everything from system health to potential security violations. Presently,
there is not a comprehensive catalog of security related event types being identified and
reviewed within the logs by security professionals.
To establish an effective event logging and monitoring program, City of Georgetown will
need to first identify high risk events that can be alerted from current logging capabilities
(NIST SP 800-53 Rev. 4 AU-6). Potential high risk events can be discerned through the risk
assessment process (NIST SP 800-53 Rev. 4 RA-3), penetration testing, and best practice
documentation. Some common threat events include:
• Multiple failed login attempts
• Elevations in access privileges
• Changes to application code
• Changes to security settings
• Process specific actions
For more risky events, such as devices that connect to the network without authorization,
the organization may consider alert generation techniques while for less risky events they
may simple review on a periodic basis. Identified events should be responded to in
accordance with the organization’s Incident Response Plan (NIST SP 800-53 Rev. 4 IR-4,
IR-5).
Once event detection processes are implemented a process to test said processes should
be established. Security assessments by internal or external independent parties can be an
effective way to ensure logging and monitoring processes are effective (NIST SP 800-53
Rev. 4 CA-2). Management should seek continuous improvement opportunities for the
event logging and monitoring program based on the results of security assessments.
We recommend management take the following actions:
1. Identify the system events that may indicate a potential security event.
2. Define monitoring techniques commensurate with associated risk.
3. Establish formal policies and procedures related to defined monitoring activities.
4. Periodically test the effectiveness of event logging and monitoring processes.
Page 109 of 173
APPENDIX B
3.1.10 Security Awareness, Training and
Education
Assigned to: City of Georgetown
Priority Medium
Recommendations
The City has implemented an acceptable use policy amongst other policies around proper
use of computers and accessing digital information. However, to ensure compliance, there
is a need to assess employee’s understanding of policies and response to cybersecurity
threats via periodic awareness and training.
End users are the first line of defense against a variety of social engineering threats and
must be relied upon to appropriately select strong passwords, perform secure day-to-day
operations, and appropriately use equipment. By not providing formal training to all
employees, the risk is increased that employees may not follow appropriate security
procedures.
We recommend a formal IT security awareness training be provided to all employees on a
periodic basis. Employees should be educated on the organization’s information security
policies upon hire, periodically (at least annually), and as major changes occur. In addition,
employees should be required to formally acknowledge that they have read and understand
the security topics discussed, and that they understand the ramifications of noncompliance.
Management should consider allocating resources for security awareness activities
(including other items, e.g. banners and posters), and enforce employee
participation/attendance within the organization.
Page 110 of 173
APPENDIX B
3.1.11 Unauthorized Mobile Code Detection
Assigned to: City of Georgetown
Priority Low
Recommendations
Mobile code is defined as any program, application, or content that is capable of being
embedded and transferred (via email, document, website, etc.). Examples of mobile
code include: JavaScript, Active X, PDF, VBscripts, etc. Avenues There are currently
multiple avenues for mobile code to be introduced into the information systems
supporting the system. Mobile code may be introduced from USB (current USB
restriction only prevent data being copied to a USB), through email, and through
downloads from websites.
The City should identify the types of mobile code that are approved for use within the
information system and educate users on the proper use of related technologies.
Likewise, organizations should define which types of mobile code are not approved for
use within the information system. Processes should be defined to identify unauthorized
mobile code deployed within the environment. These processes could include
configuration management controls, vulnerability scanning, etc. (NIST SP 800-53 Rev.
4 SC-18).
City of Georgetown does have controls in place to mitigate the risk of malicious mobile
code: antivirus controls, and limiting user access to administrator functions based on
the concept of least privilege.
We recommend management take the following actions:
1. Define acceptable and unacceptable mobile code and mobile code
technologies.
2. Deploy a process to monitor for the presence of mobile code
3. Integrate mobile code detection processes into the Incident Response Plan
Page 111 of 173
APPENDIX B
Page 112 of 173
City of Georgetown, Texas
City Council Workshop
N ovember 24, 2020
S UBJEC T:
Overview and discussion regarding the purpose of P ublic Improvement Districts (P ID) and the City’s P ID P olicy --
Wayne Reed, Assistant City Manager
I T EM S UMMARY:
Staff is presenting an overview of the purpose o f P ublic Improvement Districts (P IDs) and the City’s P ID P olicy at this
time, because the City has been approached by multiple developers seeking to submit P ID petitions to request Council to
support the creation of new P IDs to assist with funding public improvements that will meet community needs.
The City Council adopted a P ublic Improvement Distric t P olicy in December 2018. As stated in the City’s P ID P olicy,
P ublic Improvement Districts (P IDs) provide a development tool that allocates costs according to the benefits received.
A P ID can provide a means to fund improvements to meet co mmunity needs whic h co uld not othe rwise be constructed or
provided and be paid by those who most benefit from them.
Under current State Law, a P ID is a defined are a of properties, who se owners have petitioned the City to form a P ID.
City Co unc il establishes a P ID by adoption of a re so lutio n after a public hearing. The public hearing is publicized and
written notification of the hearing is mailed to all property owners in the pro pose d P ID. By petition, the owners pledge to
pay an assessment in order to receive e nhanced services and/or improvements within the P ID. The P ID must demonstrate
that it confers an extraordinary benefit, not only to the properties within the P ID, but also to the “public” which includes
the entire City. The benefit sho uld be above and beyond typical improve ments and amenities to justify the City’s
involvement.
The City’s P ID P olicy is intended to assist City Co unc il in prioritizing approval of petitions for P IDs by providing clear
and fair criteria by which to evaluate pro posals. The policy guides develo pers to improve the quality and community
(public) benefit o f a project to a degree that is superior to the le vel of community benefits typic ally generated by real
estate development projects not involving P ID financing. Such benefits include, but are not limited to, the following.
1 . Qual i ty Devel opment. The development meets or exceeds the intent of the de velopme nt, infrastructure,
and design standards of City codes;
2 . Extraordi nary B enefi ts. The development provides extraordinary public benefits that advance the vision
and goals of the Comprehensive P lan, such as, but not limited to, extension, financial contributio n, and/or
enhancement o f master planned infrastructure, dive rsity o f housing, and enhanced parks, trails, o pen space, and
recreational amenities that are available to the public;
3 . Enhance P ubl i c Servi ce and Safety. The development e nhances public services and optimizes service
delivery through its design, dedication of sites, connectivity, and other features.
4 . F i scal l y Responsi bl e. The development is financially feasible, doesn’t impair the City’s ability to provide
municipal services, and would not impose an undue financial burden on the citizens;
5 . F i nance P l an. The deve lo pe r(s) contributes financially to cover a portion of infrastructure expenses
without reimburse ment by the P ID or the City and as reflected in co nditio ns placed on the issuance of P ID
Bonds;
6 . Annexati on. A proposed P ID must be located within the City Limits. The City will not consider the
creation of a P ID where any portion of the property is located in the City’s extra-territorial jurisdiction.
It is not necessary that all community benefits be funded by P ID assessments. If a community benefit is not eligible for
P ID financing based on section 372.003, Local Government Code, the petitioner must demonstrate sufficient funding of
the benefit from other sources.
F I NANC I AL I MPAC T:
None.
S UBMI T T ED BY:
Page 113 of 173
R LD for Wayne Reed
AT TAC HMENT S :
Description
P I Ds 101 and P I D P olic y O verview 11.24.2020
Approved P I D P olic y 12.11.2018
Page 114 of 173
City Manager’s Office
Public Improvement Districts:
an Overview
Presented by
Wayne Reed, Assistant City Manager
November 24, 2020
Page 115 of 173
City Manager’s Office
Overview
•Why are we discussing PIDs?
•What is a PID?
•Why are PIDs desirable?
•What improvements can be financed by PID monies?
•What is the City’s Policy on PID creation?
•What does it mean to live in a PID?
•How do PIDs affect other City residents?
•How do PIDs affect the City?
Page 116 of 173
City Manager’s Office
Why Are We Discussing PIDs?
•Packsaddle Partners, LLC is
proposing a PID to assist
with the new Parks at
Westhaven development.
•115 acres at Maple St. and
Westinghouse Rd.
•401 Residential Units (SF
and SF-Attached)
•16 ac. Park
•1 21/2 ac. Commercial lot
Page 117 of 173
City Manager’s Office
Why Are We Discussing PIDs?
•Cordova Real Estates Ventures is proposing a PID to assist with the new Bluffview development.
•Northeast corner of Southwest Bypass and Leander Road (RM 2243 )
•Approx. 68±acres
•468 Residential Units (168 SF and 300 MF)
•Parkland along South Fork of the San Gabriel River with public access and trailhead
Page 118 of 173
City Manager’s Office
What is a PID?
What it is:
•A PID is a designated geographic area within which special
assessments are levied.
•Two types of PIDs:
•Maintenance PID (e.g., Georgetown Village PID)
•Bond-issuing PID (the proposed Parks at Westhaven and
Bluffview PIDS)
Page 119 of 173
City Manager’s Office
What is a PID?
What it is not:
•A PID is a not a separate governmental entity.
•A PID assessment is not a tax.
•A PID does not use City money or credit.
Page 120 of 173
City Manager’s Office
Why are PIDs Desirable?
Developer’s Perspective:
•Provide access to tax
exempt capital
•Lower financing costs
•Reimbursement from PID
Assessment revenues
and/or from PID Bond
proceeds
Cities’ Perspective:
•Landowner requested
•Saved financing costs means
more money for quality
development
•Expands/enhances public
infrastructure network
•No City money or credit
•Reimbursement only per City
PID Policy
•Cost of ownership to
homeowner is less than with
a MUD
Page 121 of 173
City Manager’s OfficeWhat Improvements Can Be Financed
by PID Bonds?
An improvement of the type listed that Council finds
“promotes the interest” of the City and
“confers a special benefit on a definable part” of the City
Landscaping Libraries
Fountains, lighting, signs Off-street parking and mass transit
Sidewalks, streets Water, wastewater, drainage facilities
Pedestrian malls PID formation and administrative
expenses
Art Parks and park improvements
Page 122 of 173
City Manager’s Office
What is the City’s Policy on PID Creation?
•PID Policy adopted on December 11, 2018
•“To PID or not to PID?”
•City’s PID Policy states:
Public Improvement Districts (PIDs) provide
a development tool that allocates costs
according to the benefits received. A PID can
provide a means to fund improvements to
meet community needs which could not
otherwise be constructed or provided and be
paid by those who most benefit from them.
Page 123 of 173
City Manager’s Office
What is the City’s Policy on PID
Creation?
Quality Development Extraordinary Benefits Public Service/Safety
Fiscally Responsible Finance Plan In-City Only
(no ETJ PIDS)
Page 124 of 173
City Manager’s Office
What is the City’s Policy on PID
Creation?
Developer Thresholds:
•Experience
•Financial capability to pay for construction of
the project up front, since payments from PID
Bonds are made when construction is
completed, as a reimbursement.
•Creating an “extraordinary public benefit”
•Indemnify the City
Page 125 of 173
City Manager’s Office
What is the City’s Policy on PID
Creation?
Development Thresholds:
•Exceed UDC standards
•Infrastructure meets City specifications and
standards
•Present an “extraordinary public benefit” to be
eligible for reimbursement from PID Bonds
•Have an HOA (residential) or POA (commercial)
Page 126 of 173
City Manager’s Office
What is the City’s Policy on PID
Creation?
Financial Thresholds:
•PID assessment amount ≤ $0.55 per $100 Assessed Value
•Min. AV to lien ratio for PID Bonds = 4:1
•Max. PID Bond maturity = 25 years after issuance
•Last PID Bond issuance = 10 years after 1st issuance
•Max PID Bond Limit = actual costs (plus reserves and
capitalized interest)
•MF development:
–Pay PID assessment up front in one lump sum
–Lump sum amount subtracted from reimbursement and PID Bond
limit
Page 127 of 173
City Manager’s Office
What does it mean to live in a PID?
•Pay a special assessment.
•Have a special assessment lien attached to their
tax parcel, just like for taxes.
•Be subject to foreclosure for non-payment of
the PID Assessment, just like for unpaid taxes.
•PID Assessment runs with the land (i.e., is not a
personal obligation)
Page 128 of 173
City Manager’s Office
What does it mean to live in a PID?
•Compared to MUDS:
–cost of ownership to homeowner in a PID is
less than in a MUD
–PID Assessment is certain because it is fixed
and finite (ends when paid in full)
–PID Assessment can be prepaid without
penalty or paid in annual installments (w/
interest)
Page 129 of 173
City Manager’s Office
How do PIDs affect other City
residents?
•Financially, they don’t.
•With respect to quality of life, City residents benefit
from higher quality level of development and access to
public improvements that provide “extraordinary public
benefit.”
Page 130 of 173
City Manager’s Office
How do PIDs affect the City?
What the City Council would have to do:
•If PID Policy factors are met:
–authorize staff to prepare resolutions, agreements,
plans, ordinances per Council direction
–Create the PID
–Levy special assessments
–Bill for and collect special assessments, and foreclose
if unpaid (by contract with Tax Assessor-Collector)
–Issue PID Bonds
–Update service and assessment plan annually
Page 131 of 173
City Manager’s Office
How do PIDs affect the City?
What the City Council would NOT have to do:
•Use its money to reimburse developers
•Use its money to create or administer the PID
•Lend its credit
Page 132 of 173
City Manager’s Office
Questions?
Page 133 of 173
City Manager’s Office
Next Steps
•The Parks at Westhaven (Workshop November 24, 2020)
•Bluffview (Workshop TBD)
Page 134 of 173
1
Policy and Guidelines for
Reimbursement Public Improvement
Districts
I. OVERVIEW
Public Improvement Districts (PIDs) provide a development tool that allocates costs according
to the benefits received. A PID can provide a means to fund improvements to meet
community needs which could not otherwise be constructed or provided and be paid by those
who most benefit from them.
Reimbursement PIDs are development financing tools authorized pursuant to Chapter 372 of
the Texas Local Government Code, which the developer funds infrastructure and the issuer
agreement to provide reimbursements to the developer, including through the issuance of
debt obligations secured by and payable from PID assessments (“PID Bonds”), after key
benchmarks are met.
Under current State Law, a PID is a defined area of properties, whose owners have petitioned
the City to form a PID. City Council establishes a PID by adoption of a resolution after a public
hearing. The public hearing is publicized and written notification of the hearing is mailed to
all property owners in the proposed PID. By petition, the owners pledge to pay an assessment
in order to receive enhanced services and/or improvements within the PID. The PID must
demonstrate that it confers an extraordinary benefit, not only to the properties within the
PID, but also to the “public” which includes the entire City. The benefit should be above and
beyond typical improvements and amenities to justify the City’s involvement.
The purpose of the PID policy is to outline the issues to be addressed before the City Council
Page 135 of 173
2
Policy and Guidelines for Public Improvement Districts
can support the establishment and continuation of a PID. The policy outlines such things as
petition requirements, information to property owners, and determination of annual plan of
services, budget and assessments. It addresses City administration issues, which are in
addition to the requirements of state law.
Before consenting to the creation of a PID, the City Council will consider whether the creation
of the PID is feasible, practicable, and necessary for the provision of the proposed services
and would be a benefit to the land by producing a development that exceeds minimum
development standards, and therefore warrants the City’s consent, consistent with the other
considerations in this policy.
II. COMMUNITY BENEFITS
Subject to the requirements of this policy, the City Council will prioritize approval of
petitions for PIDs supporting real estate development projects that provide for the
following public benefits to a degree that is superior to the level of community benefits
typically generated by real estate development projects not involving PID financing. Such
benefits include, but are not limited to, the following.
1. Quality Development. The development meets or exceeds the intent of the
development, infrastructure, and design standards of City codes;
2. Extraordinary Benefits. The development provides extraordinary public benefits
that advance the vision and goals of the Comprehensive Plan, such as, but not
limited to, extension, financial contribution, and/or enhancement of master
planned infrastructure, diversity of housing, and enhanced parks, trails, open
space, and recreational amenities that are available to the public;
3. Enhance Public Service and Safety. The development enhances public services
and optimizes service delivery through its design, dedication of sites, connectivity,
and other features.
4. Fiscally Responsible. The development is financially feasible, doesn’t impair the
City’s ability to provide municipal services, and would not impose an undue
financial burden on the citizens;
5. Finance Plan. The developer(s) contributes financially to cover a portion of
infrastructure expenses without reimbursement by the PID or the City and as
reflected in conditions placed on the issuance of PID Bonds;
6. Annexation. A proposed PID must be located within the City Limits. The City will
not consider the creation of a PID where any portion of the property is located in
the City’s extra-territorial jurisdiction.
It is not necessary that all community benefits be funded by PID assessments. If a
community benefit is not eligible for PID financing based on section 372.003, Local
Page 136 of 173
3
Policy and Guidelines for Public Improvement Districts
Government Code, the petitioner must demonstrate sufficient funding of the benefit
from other sources.
If it is proposed that PID Bonds are to be issued to reimburse a developer for
infrastructure that a developer would ordinarily fund at its own costs, the petition must
demonstrate how creation of the PID and financing of the infrastructure provides an
extraordinary benefit to the City as a whole and to the property in the PID, such as
accelerated development or demonstrable furtherance of a major City policy objective.
The City will not create, nor consider, a PID to solely finance the costs of constructing
infrastructure that only meets minimum City development standards.
III. GENERAL
1. PID Services and Improvements:
a. PID assessments may only be used to serve or improve public property and
may not be used to benefit or enhance private property. Listed below are
services and improvements which Georgetown’s PIDs may provide or
maintain. Other improvements allowed by statutes will be reviewed and
considered individually by the City.
i. Improved landscaping and irrigation;
ii. Enhanced entry features;
iii. Installation of fountains, distinctive lighting, and signs;
iv. Installation of art or decorations;
v. Construction or improvement of pedestrian trails and sidewalks;
vi. Establishment or improvement of parks and recreational amenities;
vii. Enhanced regional infrastructure improvements; and
viii. Construction of off-street parking facilities
b. Listed below are services and improvements which Georgetown PIDs may not
provide or maintain:
i. Swimming pools;
ii. Travel expenses;
iii. Perimeter fencing;
iv. Acquisition; construction, improvement or maintenance of privately
owned facilities or land; and
v. Any trails, parks, streets, or other public amenities that are located
within a gated community or otherwise inaccessible location may not
be funded or reimbursed by the PID.
c. Except for public improvements specifically listed in a voter-approved City
bond proposition, the City will not expend or pledge a tax increment, general
fund revenue, general obligation or certificate of obligation debt proceeds,
Page 137 of 173
4
Policy and Guidelines for Public Improvement Districts
etc. to support the costs of PID improvements, unless explicitly approved by
City Council as advancing a City purpose.
2. PIDs must be established carefully and only when related to a public purpose to avoid
a proliferation of special districts.
3. PIDs must be self-sufficient and not adversely impact the ordinary service delivery of
the City, except where City Council elects to participate in the project's costs.
4. A PID's budget shall include sufficient funds to pay for all costs above and beyond the
City’s ordinary costs, including additional administrative and/or operational costs as
well as additional maintenance costs resulting from the PID.
5. Use of assessments for partial recovery of a developer's capital costs will be allowed
only in special cases where extraordinary public benefit is shown. Only those capital
costs associated with continuing PID services will be considered for partial recovery.
6. Anyone selling land in a PID must include a "title encumbrance" which notifies any
prospective property owner of the existence or proposal of special assessments on
the property. All closing statements must specify who is responsible for payment of
the PID assessment on a pro rata share thereof.
7. A PID may not overlap the boundaries of another PID.
8. Development of property within the PID may not require variances from applicable
development regulations that result in a significantly lower standard of development.
9. The City will authorize PID Bond proceeds only to reimburse the costs of PID
improvements that have been designed and constructed to the City standards.
10. For a residential PID, the City Council will look more favorably on a petition where the
developer of a new subdivision has put in place an active homeowner’s organization.
11. If multi-family rental units are included within the proposed assessments, all of the
multi-family assessments must be prepaid by either the developer or builder, and
such assessments and prepayment amounts thereof shall be excluded any
reimbursements to the developer, including from PID Bonds.
12. The annual assessment to property owners within the PID shall be no more than the
equivalent of a $0.55 per $100 tax rate on the assessed value of their property.
13. The proposed development must be consistent with the entitlements on the
property. All required zoning, other required land use approvals or other required
permits must be in place for the development prior to the levy of PID assessments.
14. PID Administration is addressed in a separate policy.
15. All PID agreements between the City and the developer shall include language
satisfactory to the City indemnifying the City and its officials, employees and
representative.
16. Any requested adjustments or deviations from the terms of this policy for a PID shall
be clearly requested and explained (including a detailed description of the basis for
such a request under Chapter 372 of the Texas Local Government Code) in the PID
Page 138 of 173
5
Policy and Guidelines for Public Improvement Districts
petition for that PID. Any adjustments or deviations granted are at the sole discretion
of the City Council.
17. Neither the City, a public official, employee or representative shall be responsible for
any liability arising under or growing out of any approved PID. Any obligation or
liability of the developer whatsoever that may arise at any time under the approved
PID or any obligation or liability which may be incurred by the developer pursuant to
any other instrument transaction or undertaking as a result of the PID shall be satisfied
out of the assets of the developer only and the City shall have no liability.
18. The developer shall not have the right under any PID related agreement with the City
to transfer or assign its reimbursement rights such that they may be pledged to the
payment of debt service on public securities issued by any state of the United States
or any political subdivision thereof without the approval of the City.
19. If the City elects to hire a qualified third party PID administrator to administer the PID,
the costs for such administration shall be paid for with PID funds. The PID
administrator will be required to review and comment on the budget and to attend
the annual public hearing regarding the Service and Assessment Plan. Contracting
with a third party PID administrator to manage the PID shall not preclude the City
from entering into a contract with another taxing unit for the collection of the
assessments levied for the PID.
IV. PID APPLICATION REQUIREMENTS
In accordance with Texas Local Government Code Section 372, a PID Petition must state:
1. The general nature of the proposed amendments;
2. The estimated cost of the improvements;
3. The boundaries of the proposed PID;
4. The proposed method of assessment, which may specify included or excluded classes
of assessable property;
5. The proposed apportionment of cost between the PID and the municipality or county
as a whole;
6. How the PID will be managed;
7. That the persons signing the petition request or concur with the establishment of the
PID;
8. That an advisory body may be established to develop and recommend and
improvement plan to the governing body; and
9. Evidence that the petition’s signatures meet the state law requirements or the
petition will be accompanied by a reasonable fee (as determined by the City and in
addition to the required application fee) to cover the city costs of signature
verification. If the proposed PID is an expansion of an existing PID, a petition for the
new portion of the PID must identify each subdivision, or portion thereof, within the
Page 139 of 173
6
Policy and Guidelines for Public Improvement Districts
proposed boundaries of the new PID, and each subdivision or portion thereof, that is
not currently in an existing PID shall individually satisfy the requirements for a petition
under Section 372.005 of the Texas Local Government Code. Subdivision has the
meaning assigned by Section 232.021 of the Texas Local Government Code.
Before the City will consider a PID, the petitioners must provide the following for
evaluation:
1. Identification of the benefit of the PID to the affected property owners and to the city
as a whole (i.e., public purpose).
2. Map of the area, description of the boundaries of the PID for the legal notices and a
"commonly known" description of the area to be included in the PID.
3. Description of all city-owned land within the PID. Property in the PID owned by the
City shall not be subject to PID assessments. Property in the PID owned by another
governmental entity may be assessed only pursuant to an interlocal agreement
between the entity and the City.
4. “Market Feasibility Study” - The petitioner must provide evidence of the feasibility of
the real estate development project and the PID, taking into account both the market
for the proposed product types and the petitioner’s capacity to deliver the project.
The feasibility study should also include a comparison of the combined PID
assessment and ad valorem tax burden on owners in nearby developments. The
feasibility study must be prepared externally by a third party that is approved by the
City.
5. Assurance of long-term backing and support, which will include the financial plan and
build out/phasing forecasts. If proposing reimbursements through PID Bonds, the
value to lien ratio should be a minimum of 4:1.
6. Contingency Plan to address the maintenance or disposition of PID improvements and
or property that has not been dedicated to the public if a PID is dissolved.
7. Sunset clause or procedures outlined for public review of the success of the PID and a
determination of property owners whether to continue with the PID or dissolve it;
provided that if dissolved the PID must remain in effect for the purpose of meeting
obligations of indebtedness for improvements as required by state law.
8. Specified assurances to the City that the construction of improvements in the public
right-of-way will be maintained by the PID and in no way obligates the City to future
maintenance or operational costs, unless otherwise stated in a subsequent
agreement.
In addition, the following must be addressed before the City Council will take action on a
petition:
Page 140 of 173
7
Policy and Guidelines for Public Improvement Districts
1. A non-refundable "application fee" of $20,000 will be paid by the applicant to
reimburse the City for the cost of evaluating the petition. If City costs exceed the initial
fee, the developer shall replenish the account with an additional deposit.
2. A Professional Services Agreement will be entered into that outlines the
responsibilities of the City and the developer.
3. The petitioner must agree to reimburse the City or directly pay for the City’s
administrative costs for reviewing the PID petition, publishing related notices,
reviewing the Market Feasibility Study and Service Assessment Plan, including the cost
of services provided by the City’s third party PID Administrator, bond counsel,
disclosure counsel, financial advisors and any other consultant selected by the City to
assist the City in a PID-related matter.
V. BOND SIZE LIMITATIONS AND FINANCING CRITERIA
The following limitations and performance standards shall apply to a PID Bond issues
approved by the City:
1. The minimum appraised value to lien ratio at date of each PID Bond issue shall be 4:1.
The City in its sole discretion may require such values to be supported by an appraisal
of the applicable parcels prepared by an appraiser selected by the City with all
reasonable appraisal fees to be paid by the developer.
2. Maximum maturity for each series of PID Bonds (to extent allowed by law): 25
years from their date of issuance
3. The last PID Bond issuance for a PID shall be not later than the date that is ten (10)
years after the date of the first PID Bond issuance for that PID.
4. The aggregate principal amount of PID Bonds required to be issued shall not exceed
an amount sufficient to:
a. reimburse the actual costs of the qualified PID improvements;
b. fund required reserves;
c. capitalized interest to the extent determined by the City in its sole discretion
to be appropriate, if any, but not more than 12 months after the completion
of construction; and
d. pay any costs of issuance, arbitrage, administrative fees, third party fees, or
other costs related to issuance.
5. Any PID Bonds issued must include a reserve fund funded from proceeds of such PID
Bonds at the time of issuance. Refunding PID Bonds may satisfy this requirement in
cases where an existing reserve fund is transferred to the refunding PID Bonds. All
PID Bond reserve funds at the time of issuance shall be in an amount equal to the
lesser of:
a. The maximum annual debt service on the PID Bonds;
b. 10 percent of the PID Bond proceeds; or
Page 141 of 173
8
Policy and Guidelines for Public Improvement Districts
c. 125 percent of the average annual debt service on the PID Bonds.
6. The City will apply to PID Bonds the same post-issuance compliance requirements the
City applies to its general obligation and certificate of obligation debt.
7. Failure by the developer to timely submit required continuing disclosure filings will be
deemed a breach under any PID development, reimbursement or financing
agreement with the City.
8. Before the City will levy a PID assessment or authorize issuance of PID Bonds, the
petitioners and the City must enter into a PID Development Agreement that
establishes:
a. the basic terms and conditions for creation of the PID, including the provision
of community benefits and compliance with the requirements of this policy;
b. payment or reimbursement to the City of both the City’s one-time and ongoing
administrative and operational costs;
c. the financing of the PID improvements and the payment of assessment
revenue or PID Bond proceeds to reimburse the costs of the PID
improvements;
d. the planning, development, construction, management, and maintenance of
the PID improvements;
e. terms and conditions for ongoing PID administration, operation, and
management, including collection of PID assessments; and
f. any services to be funded by the PID.
9. Prior to levy of special assessments and issuance of PID Bonds the developer must
be current on all taxes, assessments, fees and obligations to the City (i.e., City
required improvements, utility agreements, including information required for
timely disclosures as required by the applicable continuing disclosure agreements,
etc.).
10. Prior to the issuance of PID Bonds, the City must have (1) confirmed the PID
improvements to be reimbursed have been completed in accordance with all
applicable design and construction requirements, including City codes and any PID
related agreements between the City and the developer (2) accepted such
improvements. As a condition to the City's acceptance of a PID improvement, the
developer shall provide the City with an assignment of the warranties and
guaranties, if applicable, to those improvements and a two year maintenance bond,
all in a form reasonably acceptable to the City. The developer must also submit to
the City for verification all invoices and other supporting documentation clearly
evidencing the actual costs of the PID improvements to be reimbursed.
11. The City, in its sole discretion, will select the members of the financing team for the
issuance of PID Bonds, including the underwriter(s) for the PID Bonds.
Page 142 of 173
9
Policy and Guidelines for Public Improvement Districts
12. The City, in its sole discretion, will determine the credit criteria/quality, market
suitability, debt structure, continuing disclosure requirements and investor
suitability requirements of all PID Bonds.
13. In the event that issuance of PID Bonds in a calendar year causes other City debt
issuances not to qualify as "qualified tax-exempt obligations" under section
265(b)(3) of the Internal Revenue Code of 1986, as amended, the developer will be
required to pay the additional costs of the City incurred as a result thereof.
In agreeing to form a PID for which PID Bonds will be issued to reimburse the costs of
constructing qualified public improvements, the City will require the following:
1. The property owner/developer must demonstrate to the City that it has the expertise
to complete the new development that the PID will support.
2. The property owner/developer must demonstrate its financial capability to initially
fund improvements prior to reimbursement and to fund improvements not being
reimbursed by the PID. Such parties must be willing to share confidential financial
information with the City and its advisors.
3. The PID Financing Agreement (or other application PID documentation) shall contain
a section, which clearly identifies the benefit of the PID to the affected property
owners and to the City as a whole (i.e. public purpose).
4. PID Bonds will only be issued to reimburse the property owner/developer for costs
already incurred.
Page 143 of 173
City of Georgetown, Texas
City Council Workshop
N ovember 24, 2020
S UBJEC T:
P resentation and discussion regarding the creation of a P ublic Improvement District (P ID) called P arks at Westhaven --
Wayne Reed, Assistant City Manager
I T EM S UMMARY:
Council is be ing aske d to provide directio n and feedbac k o n the creation of a new P ublic Improvement District (P ID) for
the P arks at We sthave n development lo cated o n the northeast c orner of Maple Street and Westinghouse Road. The total
project covers 115 acres and will contain 401 residential units, a 16 acre park, and a 2.4 acre commercial lot.
Scott Rempe, on behalf of P acksaddle Real Estate P artne rs, LL C (d/b/a P acksaddle P artners), has approac he d the City to
request a P ID to fund impro veme nts to me e t community needs and support public infrastructure asso c iated with the
development. In wo rking with the City staff, he has enhanced the development by increasing funding for the neighborhood
park to create a one of its kind in the so utheast quadrant of the City that will attract residents fro m surrounding
neighborhoods. In addition, he has expanded the ho using diversity by providing different lots sizes and two housing types.
Further, he has agreed to enhanced architectural standards for the commercial lot and for the residential homes.
Staff has reviewed the proposal and finds the proposal meets the intent of the City’s P ID P olicy.
Should Council determine that the P arks at We sthave n P ID proposal is consistent with the P ID P o licy factors, so me of
the high-level next steps include:
• Landowner to submit P ID P etition
• City to review developer supplie d financial fe asibility study utilizing City’s Bond Counsel, Financial Advisor
and Bond Underwriter
• Council to accept P ID P etition and set public hearing for P ID creation (both at same meeting)
• City staff and consultants to co mme nc e negotiating and drafting needed resolutions, agreements, plans,
ordinances
• City Council to hold a public hearing o n P ID creation and then co nsider resolution approving creatio n of
P ID and ordinance approving P ID Financing and Reimbursement Agreement
• Council to adopt Service P lan and Assessment P lan (SAP ) by ordinance
• Levy special assessments
After the creation of the P arks at Westhaven P ID, debt (revenue bonds) will be issued after there is enough assessed value
on the ground consistent with the City’s P ID P olicy (equal to or gre ate r than 4 :1 ). Annual revenues from the P ID
assessment are pledged towards debt payments.
F I NANC I AL I MPAC T:
None at this time.
S UBMI T T ED BY:
Wayne Reed, Assistant City Manager
AT TAC HMENT S :
Description
2 P resentation - P arks at Wes thaven P I D O verview 11.24.2020
Page 144 of 173
City Manager’s Office
Parks at Westhaven
PID Proposal
Presented by
Wayne Reed, Assistant City Manager
November 24, 2020
Page 145 of 173
City Manager’s Office
Overview
•Purpose of Presentation
•Proposed Parks at Westhaven
–Development Overview
•PID Policy Analysis
–Developer
–Development
–Financial
•Council Feedback and Direction
•Next Steps
Page 146 of 173
City Manager’s Office
Purpose
Staff is seeking Council’s feedback and direction on a
proposed Public Improvement District (PID) for the Parks
at Westhaven development.
•Does Council support the creation of a PID for the Parks at
Westhaven development?
•Does Council support the financial terms, architectural standards,
and the enhanced park, trails and open space improvements?
Page 147 of 173
City Manager’s Office
Parks at Westhaven Development
•Location
–115 acres at Maple Street at
Westinghouse Road (northeast
corner)
•Developer
–Packsaddle Partners, LLC
•General Features
–401 residential lots
–1 commercial lot
–16 acres Parkland/Open Space
Page 148 of 173
City Manager’s OfficePIDPolicy Compliance Evaluation –
Developer Criteria
Developer Thresholds:
•Identity
–Packsaddle Real Estate Partners, LLC d/b/a
Packsaddle Partners
https://packsaddlepartners.com/
–Formed in 2017, based in Austin
–Principals are Larry Rother and Scott Rempe
•Relevant Experience
–505 Lot SF PID in Hutto
•Financial capability
–Agreed to front costs, receive reimbursement on
completion Page 149 of 173
City Manager’s OfficePIDPolicy Compliance Evaluation –
Development Criteria
Development Thresholds:
•Exceed UDC standards? Yes.
–UDC Parkland Dedication
•UDC = 5 acres *Parks at Westhaven = 16 acres
–Parkland Improvements
•UDC = $401,000 *Parks at Westhaven = $1.4 million
–Housing Diversity
•UDC = None *Parks at Westhaven = 3 lots sizes and 2
housing types
–Architectural Standards
•UDC = None *Parks at Westhaven = Required Page 150 of 173
City Manager’s Office
PID Policy Compliance Evaluation –
Development Criteria -Enhanced Parks
Page 151 of 173
City Manager’s Office
PID Policy Compliance Evaluation –
Development Criteria -Enhanced Parks
Page 152 of 173
City Manager’s Office
PID Policy Compliance Evaluation –
Enhanced Parks
Page 153 of 173
City Manager’s Office
PID Policy Compliance Evaluation –
Development Criteria -Enhanced Parks
Page 154 of 173
City Manager’s Office
PID Policy Compliance Evaluation –
Development Criteria -Enhanced Parks
•16 acres Parkland/Open Space
•Enhanced Parkland Improvements
•All Abilities Playground
•Fitness Equipment
•Covered Pavilion
•2 miles of internal trails
•Concrete and natural surfaces
•Internally connected
•Estimated Cost = $1.4M
Page 155 of 173
City Manager’s Office
PID Policy Compliance Evaluation –Development
Criteria -Enhanced Housing Diversity
•401 Residential Units
•2 Housing Types
–SF and Attached SF
•3 Lot Sizes
–Purple = 47’ wide SF (269 lots)
–Orange = 52’ wide SF (78 lots)
–Red = 45’ wide each/90’ wide total
Attached SF (54 units)
Page 156 of 173
City Manager’s Office
PID Policy Compliance Evaluation –Development
Criteria -Enhanced Architecture
•Residential Exterior Materials
•85% of front/street/public
parkland = brick, stone, or
stucco
•50% of side/rear = brick, stone,
stucco (1st floor) and brick,
stone, cement (2nd floor)
•Residential Front Elevation
•Required articulation through
choice of features
Page 157 of 173
City Manager’s Office
PID Policy Compliance Evaluation –
Financial Requirements
Financial Thresholds:
•PID Reimbursement sought for :
–Internal Streets
–Offsite Maple Street
–Water
–Wastewater
–Erosion and Sediment Control
–Drainage
–Parks
–Grading and Trails
–Administrative Costs (professional services fees,
management fees, engineering, City fees, etc.)
Page 158 of 173
City Manager’s Office
PID Policy Compliance Evaluation –
Financial Requirements
Financial Thresholds:
•POLICY: PID assessment ≤ $0.55 per $100 AV.
PROJECT: $0.52 per $100 AV
•POLICY Min. AV to lien ratio for PID Bonds = 4:1
PROJECT: 14.7:1
Page 159 of 173
City Manager’s Office
PID Policy Compliance Evaluation –
Financial Requirements
Financial Thresholds:
•POLICY: Max. PID Bond maturity = 25 yrs after
issuance
PROJECT: same; one issuance June 2023
•POLICY: Max PID Bond Limit = actual costs (plus
reserves, capitalized interest, financing costs)
PROJECT: $7.375M PID funded ; $10.9M Developer funded
Page 160 of 173
City Manager’s Office
Council Feedback and Direction
Staff is seeking Council’s feedback and direction on a
proposed Public Improvement District (PID) for the Parks
at Westhaven development.
•Does Council support the creation of a PID for the Parks at
Westhaven development?
•Does Council support the financial terms, architectural
standards, and the enhanced park, trails and open space
improvements?
Page 161 of 173
City Manager’s Office
Next Steps
•Landowner to submit PID Petition
•City to review developer supplied financial feasibility study utilizing
City’s Bond Counsel, Financial Advisor and Bond Underwriter
•Council to accept PID Petition and set public hearing for PID creation
(both at same meeting)
•City staff and consultants to commence negotiating and drafting
needed resolutions, agreements, plans, ordinances
•City Council to hold a public hearing on PID creation and then consider
resolution approving creation of PID and ordinance approving PID
Financing and Reimbursement Agreement
•Council to adopt Service Plan and Assessment Plan (SAP) by ordinance
•Levy special assessments
Page 162 of 173
City of Georgetown, Texas
City Council Workshop
N ovember 24, 2020
S UBJEC T:
Review and discussion regarding 2021 boards and commission appointments -- Robyn Densmore, City Secretary; and
David Morgan, City Manager
I T EM S UMMARY:
It is the City’s practice to appoint board and commission members to terms of a March – February term with a term
length of two years. Due to this practice and the times coinciding with the CO VID-19 pandemic, many board members
were not able to participate in full engagement for most, if not all, of their term for the 2020-2021 year.
This City Council Workshop item will review the board and commission appointment process. Additionally, the workshop
will describe the impact CO VID-19 has had on board member participation in 2020. City staff will review an alternative
to provide all members the option to extend their terms by one year. If a member does not wish to extend their term, then
staff will gladly post and find a replacement for them. Staff will work with members to determine their desire to continue
to serve or find a replacement for them if they are unable to extend their appointment.
The Section 2.36.030 A of the Code of Ordinance which governs board appointments provides that the two-year term of
office, as well as the two-term limit, can be varied with approval by City Council.
F I NANC I AL I MPAC T:
..
S UBMI T T ED BY:
Robyn Densmore, City Secretary
AT TAC HMENT S :
Description
P resentation for Board C ommission appointments
Page 163 of 173
City Manager’s Office
Board and Commission
Member Activity during
COVID -2019/2020
Presented by
David Morgan, City Manager and
Robyn Densmore, City Secretary
November 24, 2020
Page 164 of 173
City Manager’s Office
Overview
•Current process for appointing boards and
commissions
•Statistics of board and commission actions in
2020
•Proposed changes to process
•Council Feedback and Direction
–Next Steps dependent on Council feedback and
direction
Page 165 of 173
City Manager’s Office
Current process
•It is the city’s practice to appoint board
and commission members to terms
running from March to February with a
term length of two years.
Page 166 of 173
City Manager’s Office
Current process
•Usual process runs November through
February
–Applications are open beginning the first week in
November and remain open until the end of December.
–Applications and staff recommendations are presented to
Mayor and council members mid-January.
–Mayor makes recommendations and council appoints new
members and chairs in February.
–Board member training, swearing in and appreciation
reception are held in March.
Page 167 of 173
City Manager’s Office
Board Trends
•Several boards did not initially meet in March due to
COVID
•Some boards did not meet March, April or June due to
COVID
•P&Z and HARC met “virtually” the entire time because
of state statutes requiring timely actions
•Boards are noted with a “*” if their lack of meetings
were partially or fully due to lack of action items, not
COVID related
•Some boards normally only meet on an as-needed
basis, i.e., ADA, BSC, ZBA, TIRZ Boards (not included)
Page 168 of 173
City Manager’s Office
Board Activities March -November
Board Meetings held Meetings not held % held
ADA Advisory Board (as needed)0 9 0%
Animal Shelter Adv Board 4 5 44%
Arts & Culture Adv Board 7 1 87.5%
Building Standards Comm
(as needed)
0 9 0%
Commission on Aging 0 9 0%
* Conv and Visitors Bureau Board 3 5 –no events 37.5%
* GT Gov’t and Finance Adv Board 3 6 33%
* GT Eco Devo Corporation 4 5 44%
Electric Utility Advisory Bd 6 Started in June 100%
Housing Adv Board 7 1 87.5%
*GT Transportation Adv Board 3 5 37.5%
Page 169 of 173
City Manager’s Office
Board Activities March -November
Board Meetings
held
Meetings not held % held
*GT Transportation Enhancement Bd 4 5 44%
*GT Village PID Advisory Board 5 4 55.5%
GT Water Utility Board 6 0 –June start 100%
*HARC 15 2 88%
Library Advisory Board 6 3 66%
Main Street Adv Board 6 3 –no events 66%
Parks and Rec Adv Board 3 6 33%
Planning & Zoning Comm 18 0 100%
*UDC Advisory Board 5 3 62.5%
*Youth Advisory Board 6 2 75%
Zoning Board of Adjustment 1 8 11%
Page 170 of 173
City Manager’s Office
Sec. 2.36.030. -Appointment, terms and organization.
A. Unless otherwise approved by the City Council, the term of office for all committees, boards, and
commissions of the City shall be two years in length with normal, yearly appointments. Unless otherwise
approved by the City Council, no member shall serve more than two consecutive terms on the same board,
committee, or commission. If reappointment beyond the original two consecutive terms is approved by
City Council or if a vacancy occurs, appointments shall be made to preserve staggered membership terms
on the board and ensure a balance between new and continuing members.
B. Members shall continue to serve until reappointment for that position takes place.
C. Members of the City's commissions, committees, and boards shall be appointed pursuant to the City
Charter.
D. Annual new member orientation shall occur within two weeks after the annual appointments are made
to each commission, committee, or board.
E. The Mayor shall recommend a member to serve as chairman of each board, committee, or commission,
and the City Council shall approve the recommendation by a vote of the majority of the Council, during the
annual appointment process. Should the Mayor fail to recommend a chairman for each board, committee,
or commission, and/or the Council fails to approve any chairman recommended by the Mayor, a majority
of the Council plus one may approve appointment of a chairman to serve as chairman without a
recommendation of the Mayor. Other officers are elected by a majority vote of the Members at the first
meeting after the annual appointment process. The board, committee or commission shall select a vice-
chairman, secretary and such other officers as it deems necessary. Officers serve for a term of one year.
(Ord. No. 2015-23, §2; Ord. No. 2014-97, §2(Exh. A); Ord. No. 2011-20, §2(Exh. A))
Page 171 of 173
City Manager’s Office
Possibilities
•Nothing in the code declares when the terms begin or end, just
length. Process is based on historical actions and is inconsistent
with calendar year or fiscal year.
•Application and appointment process takes approximately three
plus months.
•Council action in December delays current new appointments to
at least April or May.
•Requests have been made to roll all terms one extra year to
maintain staggered terms and to allow current appointed
members to further serve. Options would be given which allow
any members who do not want to continue to serve to resign.
Page 172 of 173
City Manager’s Office
Discussion and Questions
Next Steps –dependent on
feedback
Page 173 of 173