Audit and Risk Management Committee - December 13, 2017

That the Committee recess as the Committee of the Whole to deal with litigation or potential litigation matters, labour relations, employee negotiations, security of the property, to receive advice which is subject to solicitor client privilege and for the purpose of education/training.

Meeting No. 10 held on Wednesday, September 27, 2017

Requests to speak must be registered by noon of the business day preceding meeting day. A final deputation list will be distributed at the meeting.

1. 5_ Internal_Audit_Activities_Quaterly_Update_Q3_2017PricewaterhouseCoopers LLP 2016 Management Letter Follow-Up Report (For Action)
2. PricewaterhouseCoopers LLP Consolidated Financial Statements Audit Plan for the Year Ended December 31, 2017 (For Action)
3. TTC Top Risks Update (For Information)
4. TTC’s Corporate Risks(This report involves the security of the property of the municipality or local board)(For Action)
5. Internal Audit Activities – Quarterly Update: Q3 2017(This report involves the security of the property of the municipality or local board)(For Action)
6. Presentation: Cyber Security Risks and Mitigation Strategies – Information Technology Services (ITS)(This report involves the security of the property of the municipality or local board)(For Action)
7. Presentation: Cyber Security Risks and Mitigation Strategies – Operations Group(This report involves the security of the property of the municipality or local board)(For Action)

J. Colle (Chair), R. Byers, V. Crisanti and R. Lalonde (Members), T. Bal, R. Leary, J. O'Grady, S. Reed Tanaka, J. Ross, J. Taylor, M. Atlas, K. Bayley, A. Cerqueira, T. Coelho, S. Conforti, M. Dobson, D. Guna, M. Ismail, M. Killingsworth, C. Leach, L. Rodo, G. Turner, K. Lee and C. Finnerty.

Present for Item 4: P. Edward, W. Hafez, K. Kirovski, N. Pazzano

Present for Item 5: P. Edward, K. Kirovski

Present for Item 6: N. Cansino, R. Chhibbar, A. Milojevic K. Lillyman (Chair’s Office) and D. Magisano (Mayor’s Office) were also present. J. Colle was in the Chair.

J. Colle (Chair), R. Byers, V. Crisanti and R. Lalonde (Members), T. Bal (Acting Chief Financial Officer), R. Leary (Deputy CEO/Chief Service Officer), J. O'Grady (Chief Safety Officer), S. Reed Tanaka (Chief Capital Officer), J. Ross (Deputy Chief Operating Officer), J. Taylor (Chief of Staff), S. Conforti (Head - Finance & Treasurer), C. Leach (Acting Head -  Internal Audit), T. Coelho (Internal Audit Manager), M. Ismail (Principal Risk Advisor), K. Kirovski (Senior Internal Auditor), K. Lee (Head of Commission Services) and C. Finnerty (Co-ordinator – Secretariat Services) were present.

Nil

Commissioner Lalonde moved that the Audit & Risk Management Committee approve the minutes of the meeting held on Wednesday, September 27, 2017. The motion by Commissioner Lalonde carried.

Nil

Nil

1.PricewaterhouseCoopers LLP 2016 Management Letter Follow-Up Report It is recommended that the Audit & Risk Management Committee:

1. Receive the report; and

2. Approve forwarding a copy of the report to the TTC Board and then to the City Clerk for appropriate handling. Approved

2. PricewaterhouseCoopers LLP Consolidated Financial Statements Audit Plan for the Year Ended December 31, 2017

C. Russell, PricewaterhouseCoopers LLP addressed the Committee with an overview of the audit approach.

The Committee received this report for information.

3. TTC Top Risks Update

C. Penman, Group Station Manager, addressed the Committee with a PowerPoint presentation entitled “Extreme Subway Station Crowding”

The Committee received the presentation and report for information.

4. TTC’s Corporate Risks

It is recommended that the TTC Audit and Risk Management Committee:

1. Receive the confidential information as set out in the Confidential Attachment;

2. Note that the confidential information as set out in the Confidential Attachment is to remain confidential in its entirety as it contains information about the security of the property of the TTC. Approved

5. Internal Audit Activities – Quarterly Update: Q3 2017 Chair Colle moved that the following be added to staff recommendation #2:

“and that staff report back to the Audit & Risk Management Committee on implementation dates and overall strategies as they relate to video surveillance;” The motion by Chair Colle carried and the staff recommendations were adopted, as amended, as follows:

It is recommended that the Audit & Risk Management Committee:

1. Receive Internal Audit Activities – Quarterly Update: Q3 2017 with the Contract Review: Repair of Linear Induction Motors attachment;

2. Receive the confidential information as set out in the confidential attachment on Use of Video Surveillance completed as part of Internal Audit Activities: Q3 2017, noting that it is to remain confidential in its entirety as it involves the security of the property of the municipality or local board and that staff report back to the Audit & Risk Management Committee on implementation dates and overall strategies as they relate to video surveillance; and

3. Receive the confidential information as set out in the confidential attachment on Fraud Deterrence: Tools Management completed as part of Internal Audit Activities: Q3 2017, noting that it is to remain confidential in its entirety as it involves the security of the property of the municipality or local board. 6. Presentation: Cyber Security Risks and Mitigation Strategies – Information Technology Services (ITS) Chair Colle moved the following motion: That the action taken in camera be confirmed. The motion by Chair Colle carried and the staff recommendations were adopted, as amended, as follows:

1. Receive the confidential information as set out in the confidential attachment on the Presentation: Cyber-Security Risks and Mitigation Strategies, noting that it is to remain confidential in its entirety as it involves the security of the property of the municipality or local board; and

2. That the action taken in camera be confirmed.

7. Presentation: Cyber Security Risks and Mitigation Strategies – Operations Group Chair Colle moved the following motion: That this item be deferred to the next regular meeting of the Audit & Risk Management Committee. The motion by Chair Colle carried. The meeting adjourned at 11:32 p.m.