Financial Stewardship Accountability Transparency Port of Seattle Audit Committee Internal Audit Update Glenn Fernandes - Director, Internal Audit June 4, 2026 P69 Commission Chambers 10:00 AM - 12:00 PM Operational Excellence Governance Internal Audit Organization Structure Glenn Fernandes Director Saylor Nygaard Sr. Administrative Assistant Manager Internal Audit Spencer Bright Manager Internal Audit - Capital Ritika Marwaha Nikita Goyal Darcey Axon Brent Layman Sr. Internal Auditor Sr. Internal Auditor Sr. IT Auditor Nicole Uy Jenilee Finley Sr. Internal Auditor Sr. Internal Auditor Dan Chase Manager Internal Audit - IT Vacant Internal Auditor 2 Open Issue Status - Aging Report as of May 20, 2026 Item #5 4 Issues Outstanding (from Target Date)1 Issues 10 5 0 Not Due 0-6 months Time Outstanding 1. Security Sensitive issues from Technology Audits are excluded from the Public Session Open Issues Status presentation and will be discussed during the non-public session. See Appendix A for a detailed listing of outstanding issues, including Report Finding, Issue Owners, and Current Status as of May 20, 2026. 3 Report Title Public Art Program Timekeeping - Maritime Accounts Receivable Management - Fisherman's Terminal Airport Dining & Retail - ACDBE Program Procurement FMLA 3rd Party Administration South King County and Port Communities Fund C Concourse Expansion Main Terminal Low Voltage Post IAF Airline Realignment Planewear Tenant Reimbursement Agreement (CT-09) Capital Project Prioritization Process Data Centers Audit Baggage Conveyer Systems (AVM) Payment Card Industry (PCI) Assessment EAN Holdings, LLC1 Sixt Rent a Car HIS HCL SEA FB, LLC Marmot Mountain, LLC DBA Exofficio 1. This audit has been deferred to 2027 due to staff turnover 2026 AUDIT PLAN STATUS Type Performance Performance Performance Performance Performance Performance Performance Performance - Capital Performance - Capital Performance - Capital Performance - Capital Performance - Capital IT IT IT Contract Compliance Contract Compliance Contract Compliance Contract Compliance Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Complete KEY In Process Not Started 4 Internal Audit Capital GC/CM Continuous Audits Item #6  RCW 39.10.385 requires an independent audit  Auditor provides the Audit Committee with annual updates and final reports upon completion of each project Capital GC/CM Continuous Audits Auditor Main Terminal Low Voltage System Upgrade R.L. Townsend Post IAF Airline Realignment R.L. Townsend C Concourse Expansion Project R.L. Townsend Primary Fire Station Continuing Operations Preservation Port Internal Audit Baggage Optimization Phase 3 Fort Hill Concourse Low Voltage Upgrade Port Internal Audit South Concourse Evolution Talson Main Terminal Improvement Program Contract Anticipated in 2026 Concourse HVAC Improvement/Renewal Program Contract Anticipated in 2026 5 Updated 2026 Audit Plan Limited Contract Compliance • EAN Holdings, LLC1 • Sixt Rent a Car • HIS HCL SEA FB, LLC • Marmot Mountain, LLC DBA Exofficio Item #6 Performance • Public Art Program • Timekeeping - Maritime • Accounts Receivable Management - Fishermen's Terminal • Procurement - Personal Service Agreements • FMLA 3rd Party Administration • South King County and Port Communities Fund • Airport Dining & Retail - ACDBE Program Performance - Capital Information Technology C Concourse Expansion Main Terminal Low Voltage Post IAF Airline Realignment Planewear Tenant Reimbursement Agreement (CT-09) • Capital Project Prioritization Process • Data Centers • Baggage Conveyer Systems (AVM) • Payment Card Industry (PCI) Assessment • • • • 1. This audit has been deferred to 2027 due to staff turnover 6 Adoption of Global Internal Audit Standards Item #7 Internal Audit currently uses both the Governmental Auditing Standards (Yellow Book) and the Global Internal Audit Standards (Red Book) The Red Book is published by the Institute of Internal Auditors (IIA) The Global Internal Audit Standards were added at the request of the Audit Committee external member in October 2012 and adopted in December 2012 Since then, the department has followed both the Red and Yellow book 7 Adoption of Global Internal Audit Standards Item #7 The Yellow Book Recommends that Internal Audit Departments, that follow the Yellow Book and are structured similar to the Port's IA Department, use the Red Book. Internal Auditors  3.57 Certain entities employ auditors to work for entity management. These auditors may be subject to administrative direction from persons involved in the entity management process. Such audit organizations are internal audit functions and are encouraged to use the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing, in conjunction with GAGAS. 8 Benchmarking & Efficiencies Item #7 The majority of Airports operators in the U.S. use only the Red Book Those that use the Yellow Book are generally managed by cities Using two standards duplicate work and are overly burdensome for staff Staff has indicated that mixing Red and Yellow Book standards creates confusion and lacks clarity Three staff members have passed the IIA's CIA exam (Red Book) One has successfully passed parts 1 & 2 of the CIA exam 9 Item #7 Request for Adoption of Global Internal Audit Standards The Port of Seattle's Internal Audit Department is requesting approval for making the Institute of Internal Auditors' Global Internal Audit Standards the primary guidelines that will be followed Effective for Audits beginning in the 3rd Quarter of 2026 Updated charters will be presented to the Committee in September of 2026 10 Audits Completed in Second Quarter - 2026 Items #8-11 1. Time Approval Controls - Marine Maintenance 2. Capital Project Prioritization Process 3. Procurement - Personal Service Agreements 4. Data Centers 1 1 Information Technology audits are security sensitive and are not discussed in public meetings; all or part of the audit reports may be exempt from public records disclosure under RCW 42.56.420. 11 Time Approval Controls - Marine Maintenance Item #8  Scope: January 2025 - February 2026  The Port of Seattle (Port) employs approximately 2,500 people, comprised of both represented and non-represented employees  Objective:  Evaluate time approval process  Segregation of duties  Compliance with policies and procedures 12 Time Approval Controls - Marine Maintenance Item #8  Payroll costs represent the largest operating costs - 62%  919 adjustments after being reviewed and approved  Employee time entered in Maximo and then uploaded into PeopleSoft HCM Most common checks performed: • Each employee has at least 40 regular straight time hours for each week • Each employee has at least 8 or 10 regular straight time hours a day 13 Item #8 1) Rating: High The approval process to validate the accuracy of time submitted is not adequately designed or operating effectively. The absence of automated tools, such as a formal timekeeping or time clock system, limits management's ability to independently verify hours worked and assess the accuracy of reported time.  919 corrections in 14 months  No formal review and approval of time for Crew Chiefs  Outdated work order estimates  SOP for pre-approved OT not consistently followed  Employees could request changes after approval without notifying manager  Employees are sometime allowed to work through required lunch and receive one hour of overtime instead of the 30 minutes allowed by the CBA 14 Recommendations Item #8  Develop a formal process of reviewing and approving timesheets  Implement an electronic time clocks  Updated work order estimates  Restrict post-approval changes without formal re-approval and implement reporting to monitor and review all adjustments  Enforce CBA requirements (e.g., meal periods) and provide training to ensure consistent application and accountability 15 Management Response Item #8  Marine Maintenance (MM) will develop and implement a standardized time review and approval process.  Management partially concurs with recommendation. MM agrees that automation opportunities should continue to be evaluated to improve payroll accuracy and efficiency.  MM recognizes that outdated preventative maintenance work estimates and inconsistent overtime documentation contribute to operational inefficiencies and reduce management visibility into labor utilization.  Post-approval payroll changes should include documented justification and appropriate crew chief and management visibility.  MM will reinforce compliance with collective bargaining agreement requirements and applicable port policies. Management will discuss in detail. (Full response in Audit Report No. 2026-04) 16 Item #8 2) Rating: Medium Although supervisors play a critical role in maintaining maritime operations and developing workforce competency, managers are largely absent from payroll review and approval and need to play a more active role in the process.  Represented employees are governed by the CBA  IA acknowledges the critical role of represented employees but believes that non-represented managers retain responsibility for oversight 17 Recommendations Item #8 Redesign the payroll process so that responsibility for payroll oversight and execution resides not only with crew chiefs, but also with non-represented managers. 18 Management Response Item #8  Management agrees additional oversight opportunities should be evaluated to strengthen payroll governance and reduce potential perception concerns. However, implementation of structural changes involving represented workforce may require broader coordination with labor relations, HR, legal and union leadership, as well as evaluation of operational impacts, staffing levels and bargaining obligations. Management will discuss in detail. (Full response in Audit Report No. 2026-04) 19 Capital Project Prioritization Process Item #9 The Port invests approximately $1 billion in long-term infrastructure projects annually and is organized into three primary operating divisions: Aviation, Maritime, and the Economic Development Division Assets previously acquired by the Economic Development Division have been reassigned to Maritime for Capital Improvement Plan (CIP) purposes Capital projects are delivered through the Aviation and Maritime divisions who prepare a CIP on a five-year planning cycle Objective of audit was to evaluate how the Port prioritizes capital projects by assessing the adequacy and effectiveness of capital project evaluation and planning processes 20 Capital Project Prioritization Process Item #9 Aviation  CIP 2026-2031 More than 81 projects Estimated $7.5 billion rough order of magnitude  Aviation has maintained a project prioritization framework since 2016 and, in 2025, engaged external consultants to assess its capital governance processes  Aviation's controls are operating effectively and have already implemented several of the consultant's recommended process improvements Maritime  CIP 2026-2030 More than 170 projects Estimated $610 million rough order of magnitude 21 Item #9 1) Rating: Low Maritime does not have a formal documented process for project intake, prioritization, or approval within the CIP. This makes it more susceptible to inconsistent decision-making, undocumented or poorly supported capital planning decisions, and misalignment with strategic priorities.  Exceptions identified: 1) Intake Process - Maritime does not have a documented SOP governing project intake or prioritization 2) Scoring and Approval Process - Maritime does not have a formal scoring methodology, and approval decisions are not formally documented 3) Key Controls - Maritime lacks documented guidance governing the overall CIP project prioritization process 22 Recommendations Item #9  To enhance transparency and accountability, Maritime should develop a formalized CIP governance framework, including:  A documented project intake process  A standardized scoring methodology  Formal approval requirement, and  End-to-end policies and SOPs outlining roles, responsibilities, scoring criteria, and documentation standards Note: Maritime stated that they are currently developing enhancements to their overall CIP process. However, since it is a work in progress, we were unable to verify during the audit. 23 Management Response Item #9  Maritime management acknowledges the low audit finding and is strengthening its CIP governance structure and documentation, including SOPs for planning and CIP development  A formal intake process has been used for small projects since 2018 and large projects since 2022, but documentation of the process is necessary  Prioritization processes will be improved; a scoring system may not fit the diverse Seaport needs due to multiple business lines  Maritime will develop and implement a prioritization approach that best aligns its limited capital capacity with the highest needs DUE DATE: 12/31/2027 Management will discuss in detail. (Full response in Audit Report No. 2026-08) 24 Item #10 Procurement  The Port's Central Procurement Office (CPO) is comprised of four teams: Purchasing, Public Works, Service Agreements (Personal & Professional Services), and Planning & Analytics  IA focused on Personal Service Agreements, testing overall compliance with:  Internal Policies and Procedures  State Laws and Regulations (RCW 53.19)  Industry's Best Practices (per the National State Auditors Association) We did not identify any issues that warranted reporting. (Full Audit Report No. 2026-06) 25 Questions/Committee Comments Item #12 26 Appendix A - Aging of Outstanding Issues as of May 20, 2026 27 Appendix A - Aging of Outstanding Issues as of May 20, 2026 Performance, Capital, and Limited Contract Compliance Audits Audit Type Audit Title Days Outstanding (from Target Report Date Date) Operational Utilities Management Medium Rating Target Date Operational Accounts Receivable Management - Fishermen's Terminal Medium 2/15/2027 3/4/2026 Operational Accounts Receivable Management - Fishermen's Terminal Medium 6/15/2026 3/4/2026 Operational Public Art Program Medium 12/31/2026 3/3/2026 12/31/2025 10/16/2024 Issue Owner Report Finding Current Status from Management as of 5/20/2026 139 Managing Dir Maritime A leak detection monitoring system to 5/15 - Management provided a response via email. According to identify and/or prevent water leaks from the response, not much progress has been made to date. occurring does not exist. Unique to However, a leak at Terminal 102 on the waterside under the Maritime, some infrastructure is dock occurred re-emphasizing the need for a leak detection positioned underwater, creating a system. Management is going to engage the facilities team for greater challenge to identify and repair further discussion. leaks. AC update: A leak estimated at approximately 2.68 million gallons occurred at Terminal 102 and has been repaired. Management is determining most appropriate strategy regarding implementation of a leak detection system. 8/25: No update required until Q4 2025. 11/17/2025: Email and management discussions were held with management who indicated the bids had been received. These bids will be used for a go/no go decision. 5/20/2026: We have requested, but management has not provided an update. N/A Chief Operating Officer Decisions related to delinquent accounts Maritime at Fishermen's Terminal are based on informal discussions and undocumented commitments, rather than established criteria. This has contributed to a significant number of accounts remaining delinquent beyond 90 days. N/A Chief Operating Officer Continued weaknesses in Segregation of Maritime Duties (SOD) undermine effectiveness of key internal controls. N/A Chief Operating Officer The Port is not fully compliant with the Aviation Policy Directive on Port-Wide Arts and Cultural Program (Directive). Specific clauses within the Directive are not being followed and/or implemented. 1) Annual Workplan Update: Interim due 6/30/26; Fully finalized process due 12/31/26 2) 1% Allocation Methodology Update: Due 12/31/26 3) Program Guidelines Update: Due 6/30/26 28