Financial Stewardship Accountability Transparency Port of Seattle Audit Committee Internal Audit Update Glenn Fernandes - Director, Internal Audit March 19, 2026 P69 Commission Chambers 1:30 PM - 3:00 PM Operational Excellence Governance Internal Audit Organization Structure Glenn Fernandes Director Saylor Nygaard Sr. Administrative Assistant Spencer Bright Manager Internal Audit Manager Internal Audit - Capital Ritika Marwaha Nikita Goyal Darcey Axon Brent Layman Sr. Internal Auditor Sr. Internal Auditor Sr. IT Auditor Nicole Uy Jenilee Finley Sr. Internal Auditor Sr. Internal Auditor Dan Chase Item #3 Manager Internal Audit - IT Derek Dewar Concession Auditor 2 Internal Audit Director's Annual Communication Item #3 Annual communication is required by the Institute of Internal Auditors (IIA) Global Internal Audit Standards on:  Organizational Independence  Internal Audit Charter  Quality Assurance and Improvement Program 3 Independence Requirement Item #3 IIA Standards require annual confirmation of organizational independence of the internal audit function Internal Audit Department continues to maintain organizational independence by reporting functionally to the Audit Committee and administratively to the Executive Director 4 Internal Audit Charter Item #3 The Charter was most recently updated in September 2020. The Charter defines Internal Audit Department's:  Authority and Accountability  Mission and Scope  Responsibility  Independence and Objectivity  Commitment to Quality 5 Quality Assurance Requirement Item #3  Generally Accepted Government Auditing Standards (GAGAS)/Government Accountability Office (GAO) require an external peer review every three years  IIA Standards require both an internal and external quality assurance and improvement program; external assessments need to occur at least every five years  An external peer review was conducted by the Association of Local Government Auditors (ALGA) in August of 2025  An internal quality review was conducted in both 2025 and in 2026 6 Report Title Public Art Program Timekeeping - Maritime Accounts Receivable Management - Fisherman's Terminal Inventory Management - Marine Maintenance 1 Airport Dining & Retail - ACDBE program2 Procurement FMLA 3rd Party Administration South King County and Port Communities Fund C Concourse Expansion Main Terminal Low Voltage Post IAF Airline Realignment Planewear Tenant Reimbursement Agreement (CT-09) Capital Project Prioritization Process Data Centers (ICT & AVM) Baggage Conveyer Systems (AVM) Payment Card Industry (PCI) Assessment Data Protection (ICT) 3 EAN Holdings, LLC Sixt Rent a Car HIS HCL SEA FB, LLC Marmot Mountain, LLC DBA Exofficio 2026 AUDIT PLAN STATUS Performance Performance Performance Performance Type Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Performance Performance Performance Performance - Capital Performance - Capital Performance - Capital Performance - Capital Performance - Capital IT IT IT IT Contract Compliance Contract Compliance Contract Compliance Contract Compliance 1.This audit is removed from the plan and moved to a contingency audit. It will be replaced with the Airport Dining & Retail - ACDBE program Audit. 2.This audit has been added to the plan at the Audit Committee's Request Complete KEY In Process Not Started 3.This audit has been replaced with the Payment Card Industry (PCI) Assessment, at Port Management's request 7 Internal Audit Capital GC/CM Continuous Audits Item #4  RCW 39.10.385 requires an independent audit  Third-party independent auditor provides the Audit Committee with annual updates and final reports upon completion of each project  The following table represents GC/CM projects that Internal Audit is overseeing: Capital GC/CM Continuous Audits Main Terminal Low Voltage System Upgrade Under Contract Post IAF Airline Realignment Under Contract C Concourse Expansion Project Under Contract Eastside Fire Station Under Contract Baggage Optimization Phase 3 Under Contract Concourse Low Voltage Upgrade Under Contract South Concourse Evolution Under Contract Main Terminal Improvement Program Contract Anticipated in 2026 Concourse HVAC Improvement/Renewal Program Contract Anticipated in 2026 8 Updated 2026 Audit Plan Limited Contract Compliance • EAN Holdings, LLC • Sixt Rent a Car • HIS HCL SEA FB, LLC • Marmot Mountain, LLC DBA Exofficio Item #4 Performance • Public Art Program • Timekeeping - Maritime • Accounts Receivable Management - Fishermen's Terminal • Inventory Management - Marine Maintenance1 • Procurement • FMLA 3rd Party Administration • South King County and Port Communities Fund • Airport Dining & Retail - ACDBE program2 Performance - Capital Information Technology C Concourse Expansion Main Terminal Low Voltage Post IAF Airline Realignment Planewear Tenant Reimbursement Agreement (CT-09) • Capital Project Prioritization Process • Data Centers (ICT & AVM) • Baggage Conveyer Systems (AVM) • Data Protection (ICT)3 • Payment Card Industry (PCI) Assessment • • • • 1. This audit is removed from the plan and moved to a contingency audit. It will be replaced with the Airport Dining & Retail - ACDBE program Audit. 2. This audit has been added to the plan at the Audit Committee's Request 3. This audit has been replaced with the Payment Card Industry (PCI) Assessment, at Port Management's request 9 Items #5-7 Audits Completed in First Quarter - 2026 1) Accounts Receivable Management - Fishermen's Terminal 2) Public Art Program 3) Planewear Tenant Reimbursement Agreement (CT-09) 10 Item #5 Accounts Receivable Management - Fishermen's Terminal Scope: January 2024 - December 2025 Objective: Evaluate accounts receivable (AR) processes Segregation of duties Compliance with policies and procedures 11 Item #5 1) Rating: Medium Decisions related to delinquent accounts at Fishermen's Terminal are based on informal discussions and undocumented commitments, rather than established criteria. This has contributed to a significant number of accounts remaining delinquent beyond 90 days. Port Procedure: 1. Collection efforts begin at 30 days 2. Dunning letters are system generated 25 days from due date 3. Collectors will send second letter at 30-59 days from date of invoices 4. Final demand letter 60-89 days from date of invoice 5. If the account remains uncollectible after 180 days, after attempting all standard account collection procedures, the account may be written off, subject to authorization 12 Item #5 1) Rating: Medium Status (12/31/25) Litigation Collections Dispute Pending/Open Total 0-30 $396,010 768 574 148,693 $546,044 31-60 1,184 861 87,376 $89,421 Days Past Due 61-90 91-180 189 237 80,740 $81,166 236 524 153,966 $154,725 Over 180 $136,671 21,658 2,166 556,872 $717,367 Total $532,681 24,035 4,361 1,027,646 $1,588,723  $717,367 - 45% over 180 days  $1,027,646 - 65% Decision for resolution pending  $599,000 at 12/31/2023 to $1.59M at 12/31/2025 13 Recommendation: Item #5 FT should formalize written standard operating procedures (SOPs) for accounts receivable monitoring and escalation that align with AFR policy. The SOPs should define clear escalation thresholds, require standardized documentation of customer communications and payment arrangements, and clarify roles between FT and AFR. Any deviation from established escalation criteria should require documented secondary managerial approval. 14 Management Response Item #5 FT Management will create and establish recommended SOPs to be operationalized within 6 months In reference to the employee who called collections, there will be overall retraining to all FT staff of acceptable steps in these processes DUE DATE: 02/15/2027 Management will discuss in detail. (Full response in Audit Report No. 2026-01) 15 Item #5 2) Rating: Medium Continued weaknesses in Segregation of Duties (SOD) undermine effectiveness of key internal controls.  Segregation of Duties (SOD) weaknesses persist: An audit performed in March 2023 identified similar issues  Excessive system access: Five FT staff have MVMS administrator rights allowing customer data changes without a secondary review  Conflicting responsibilities: The same staff involved in moorage utilization also perform collection and billing functions Recommendations 1. Separate moorage promotion, billing and collections functions; alternatively implement compensating controls. 2. Perform periodic access reviews to ensure only authorized staff can modify customer or financial data. 16 Management Response Item #5  Currently if any adjustments are made, MVMS was built to save ALL changes with (who, what and when), therefore the concern of audit item #1 about "data without documented secondary review" is inaccurate. There is visibility of changes. IN MVMS 2.0 there are changes that will be made on authorizations for staff (this was affected during cyber attack and was put on hold until 2.0 work on system began).  Item #2, due to the nature of our business and small team the assisting with collections and billing is not assisting, it is review of changes (but they do not actually do the changes), so that it does not sit with one person (which was the issue in the last audit), therefore putting less risk of having only one person doing this work. This step has been considered a high level of customer service for the team because they are able to understand dynamics of our customers and adjust and manage as needed. There will be more periodic independent oversight as suggested. DUE DATE: 06/15/2026 Management will discuss in detail. (Full response in Audit Report No. 2026-01) 17 Item #5 3) Rating: Low Credit risk assessment procedures are not performed before executing commercial and recreational moorage agreements with lessees.  Evaluating the lessee's ability to pay increases the chance that the Port could recover money if an account becomes uncollectible. These steps could include proof of insurance, security deposit, first and last month's rent, and collateral evaluation. Recommendation Management should assess which due diligence steps could be implemented within existing resources to reduce financial exposure. 18 Management Response Item #5 FT tariff #6 required proof of required certain maritime insurance, proof of current registration, and seaworthiness or proof of Coast Guard Inspection. There will be a re-set and re-training with FT business staff on ensuring these are annually updated. DUE DATE: 02/15/2027 Management will discuss in detail. (Full response in Audit Report No. 2026-01) 19 Public Art Program Item #6  SEA was the country's first public airport to establish a public art collection (late 1960s) Diverse range of styles and artists (regional and emerging) Airport has 400 pieces of artwork; variety of forms (glass/ photography/sculptures/paintings/digital media) Art Pool fund:  Calculated as 1% of eligible capital projects from the Aviation Finance & Budget (AV F&B) 2022-2026 cashflows  $23.6M balance as of 12/31/25 2024 Art Pool spend $3,518,881 2025 Art Pool spend $4,369,736 20 Item #6 1) Rating: Medium The Port is not fully compliant with the Policy Directive on Port-Wide Arts and Cultural Program (Directive). Specific clauses within the Directive are not being followed and/or implemented.  Three exceptions identified: 1) Annual Workplan incomplete for 2024/not created for 2025 2) A corresponding 1% contribution was not funded to account for the proportional change of capital construction budgets increases 3) Guidelines have not been updated for over 16 years 21 Management Response Item #6 1. Annual Workplan  Management agrees that a more structured and formal annual workplan will improve transparency, prioritization, and program oversight, and will provide clearer direction to the Port-Wide Arts and Culture Board in carrying out its advisory role. 2. 1% Allocation Methodology  This approach was adopted as a governance decision and applied consistently. The issue therefore represents a need for policy clarification and formal alignment rather than a breakdown in internal controls. 3. Program Guidelines  Management will upload the document to the Port's website to ensure public visibility. After reviewing the Board Charter, it has been noted that there is no requirement for subsequent Commission adoption of the Board's Public Art Policy and Guidelines. DUE DATE: Various Management will discuss in detail. (Full response in Audit Report No. 2026-02) 22 Planewear Tenant Reimbursement Agreement Item #7  Planewear, a small local womanowned business, entered a lease with the Port in 2018  The original space experienced multiple impacts from the Concourse C Expansion, which would have required it to close for several years  A TRA for design and remodel costs (not-to-exceed $1.5 million) was executed in June 2023  Planewear reopened in April 2025 23 Item #7 1) Rating: Low Port pay application reviewers did not obtain documentation required by the Tenant Reimbursement Agreement prior to payment.  Tenant was required to submit approved Statements of Intent to Pay Prevailing Wages and Affidavits of Wages Paid from all contractors before the Port issued final reimbursement  Port received the general contractor's Intent but did not receive required Intents from three subcontractors, or the general contractor's Affidavit before issuing final payment 24 Recommendations Item #7  Pay application reviewers should ensure that all required documentation is collected and verified prior to approving reimbursement  Tenant Reimbursement Agreement language should be reviewed to determine whether the Intent and Affidavit requirements are still necessary and amended accordingly 25 Management Response Item #7  AVPMG Management agrees with the recommendations and will be updating the Tenant Reimbursement Agreement Responsibilities SOP to better clarify roles and responsibilities regarding verification of documentation necessary prior to reimbursement  AVPMG will work with Construction Management, CPO, POS legal department, Commercial Management, and Business and Properties to determine if the Intent and Affidavit requirements are still necessary  AVPMG will review the updated procedure with all Tenant Project Management staff managing TRA projects to ensure they are familiar with the updated process DUE DATE: 08/31/2026 Management will discuss in detail. (Full response in Audit Report No. 2026-03) 26 Questions/Committee Comments Item #8 27