This report is a matter of public record, and its distribution is not limited. Additionally, in accordance with
the Americans with Disabilities Act, this document is available in alternative formats on our website.
INTERNAL AUDIT REPORT
Operational Audit - Delegation of Authority
January 2023 – October 2024
Issue Date: November 18, 2024
Report No. 2024-19
Delegation of Authority
2
TABLE OF CONTENTS
Executive Summary ................................................................................................................................................ 3
Background............................................................................................................................................................. 4
Audit Scope and Methodology ............................................................................................................................ 6
Appendix A: Risk Ratings ...................................................................................................................................... 7
Delegation of Authority
3
Executive Summary
Internal Audit (IA) completed an audit of the Delegation of Authority for the period January 2023 through
October 2024. The purpose of the audit was to assess the effectiveness and compliance of the
Delegation of Authority and Responsibility (DORA) Policy Directive in achieving its intended goals.
On January 24, 2023, Resolution No. 3810 was adopted, repealing all prior resolutions related to the
Commission’s Delegation of Authority and Responsibility to the Executive Director (ED). This resolution
increased the ED's signatory authority from $300K to $2 million, with certain exceptions, and took effect
on April 3, 2023.
Section 3 of Resolution No. 3810 stated “The Internal Audit Department shall review the effectiveness
and adherence to the DORA Policy Directive and as part of that review, shall interview Commissioners
about their understanding and functioning of the Delegation of Authority, and shall provide this audit
report to the Commission within four years of the passage of this resolution.”
In general, we concluded that Port management’s internal controls were operating effectively.
We did not identify any issues that warranted reporting.
Glenn Fernandes, CPA
Director, Internal Audit
Responsible Management Team
Steve Metruck, Executive Director
Karen Goon, Deputy Executive Director
Delegation of Authority
4
Background
The Port’s DORA Policy Directive, adopted on January 24, 2023, and effective April 3, 2023, repealed
prior resolutions and established new delegations from the Commission to the Executive Director (ED).
This directive increased the ED’s signatory authority from $300,000 to $2 million, with some exceptions.
The DORA review process is managed through SharePoint and Microsoft Power Automate, where staff
submit standardized request forms and documentation to the sponsoring Executive Leadership Team
(ELT) member. The ELT member reviewed, approved, and forwarded requests to the Deputy Executive
Director (DED), who then consulted with the Commission Chief of Staff, Executive Chief of Staff,
Finance, and Legal departments, as needed. For specific cases, Central Procurement was also notified.
The DED then submitted the request, along with any additional clarifications, to the ED for approval.
Items that might have drawn Commissioner interest were flagged in “Look Ahead” and “Agenda Review”
meetings with the Commission President, where decisions were made on whether to place the item on
the consent agenda or highlight it in the weekly briefing. A monthly report of approvals was submitted at
the first Commission meeting each month, and contracts resulting from the ED’s delegation process
were accessible on the Port’s contracts webpage.
See the workflow below:
Source: DORA one year update to Commissioners
We interviewed management and staff who frequently used the DORA process to gather feedback on
their understanding of the new process and on any perceived benefits or challenges compared to the
previous approach. Under the former process, items requiring Commission approval often took up to
eight weeks for authorization. According to users, the new process significantly reduced this timeline,
with approvals typically granted within a few weeks. Some delays exist at the ELT member approval
level, often due to demanding schedules or periods of leave.
Subject matter
expert launches
request
ELT member
reviews and
approves
DED review
Exceptions to
process: “…subject
matter areas where
Commission has
spoken in the form
of Policy Directives
and Order”
DED approves with
recommendations
on whether to insert
in ED comments or
highlight for
Commissioners in
2:2:1
ED reviews and
approves
A monthly summary
of all approvals is
included on the first
Commission agenda
of the following
month
Delegation of Authority
5
From April 2023 to August 2024, 112 requests were approved. The tables below present estimated time
savings based on our discussions with management:
Metric
Time/Value
Estimated Time for full Commission Process
8 weeks
Estimated Time for ED Approval Process (3810)
2 weeks
Estimated Time Savings
6 weeks
Total Approved Requests during Audit Period
112
Estimated Time Taken to create a Presentation for the Commission Agenda
10-13 hours
Estimated Time Taken through ED Delegation Process
1-2 hours
Estimated Time Savings per Request
10 hours
Estimated Total Time Savings
1120 hours
The audit also reviewed a citizen’s concerns about the Port’s issuance of 2024 tariffs under a potentially
outdated delegation of authority and a delay in implementing re-delegations after the adoption of
Resolution 3810. After the citizen raised this concern, a typo was identified in a Maritime memo, which
was not a legal document and did not affect the delegated authority. Maritime subsequently corrected
it, confirming that the governing authority was Resolution 3810, and the re-delegation policy was EX-
2A, Part III.E. Aside from this initial error, the Port was in compliance with current policy requirements.
Delegation of Authority
6
Audit Scope and Methodology
We conducted the engagement in accordance with Generally Accepted Government Auditing Standards
and the International Standards for the Professional Practice of Internal Auditing. These standards
require us to plan and execute the engagement to obtain sufficient, appropriate evidence to support our
findings and conclusions based on the engagement objectives. We believe the evidence obtained
provides a reasonable basis for our findings and conclusions.
In some instances, we used judgmental sampling methods to determine the samples selected for our
audit test work. In those cases, the results of the work cannot be projected to the entire population.
The period audited was January 2023 through October 2024 and included the following procedures:
Policy and Procedure Review
• Reviewed foundational documents, including the Port’s Delegation of Responsibility and
Authority to the Executive Director, as amended January 01, 2023, Policies EX-2 and EX-2A,
and Schedule EX-2A
• Reviewed communication, training, and monitoring processes
Management and Staff Interviews
• Conducted interviews with management and staff from various departments, to gain anecdotal
evidence of the time and resources required to compile material and to present to the
Commission, when seeking authorization
• Gauged staff’s general understanding of the delegation schedules, monitoring and ratification
processes, and training opportunities
• Elicited feedback, using open-ended questions, to identify opportunities that may improve the
limits and delegation process
Commission Interviews
• Obtained feedback from Commissioners on time savings and areas for potential improvement in
the delegation process
Substantive Tests
• Selected contracts approved within the new ED delegation limits to verify compliance with
schedule limits and directive requirements
• Reviewed the ratification log and supporting documentation for compliance and corrective action
as necessary
Delegation of Authority
7
Appendix A: Risk Ratings
Observations identified during the audit are assigned a risk rating, as outlined in the table below. Only
one of the criteria needs to be met for an observation to be rated High, Medium, or Low. Low rated
observations will be evaluated and may or may not be reflected in the final report.
Rating
Financial/
Operational
Impact
Internal
Controls
Compliance Public
Commission/
Management
High Significant
Missing or
partial
controls
Non-compliance
with Laws, Port
Policies,
Contracts
High probability
for external audit
issues and / or
negative public
perception
Requires
immediate
attention
Medium Moderate
Partial
controls
Not
functioning
effectively
Partial
compliance with
Laws, Port
Policies
Contracts
Moderate
probability for
external audit
issues and / or
negative public
perception
Requires
attention
Low Minimal
Functioning
as intended
but could be
enhanced
Mostly complies
with Laws, Port
Policies,
Contracts
Low probability
for external audit
issues and/or
negative public
perception
Does not
require
immediate
attention
