INTERNAL AUDIT REPORT Capital Project Audit Capital Project Prioritization Process April 2025-April 2026 Issue Date: May 20, 2026 Report No. 2026-08 This report is a matter of public record, and its distribution is not limited. Additionally, in accordance with the Americans with Disabilities Act, this document is available in alternative formats on our website. Project Prioritization TABLE OF CONTENTS Executive Summary ................................................................................................................................................. 3 Background ............................................................................................................................................................. 4 Audit Scope and Methodology ............................................................................................................................... 5 Schedule of Observations and Recommendations ................................................................................................ 6 Management Response and Action Plan ............................................................................................................... 7 Appendix: Risk Rating s ............................................................................................................................................ 8 2 Project Prioritization Executive Summary We completed an audit of the Port of Seattle's (Port) Capital Project Prioritization Process for the period April 2025 through April 2026. The objective was to evaluate how the Port prioritizes capital projects by assessing the adequacy and effectiveness of capital project evaluation and planning processes within the Aviation and Waterfront Project Management (Maritime) divisions, including the identification and management of related risks. The audit also identified best practices and opportunities for improvement. The Aviation division engaged external consultants in 2025 to assess its capital governance processes and has implemented several key process improvements, which we verified. The Maritime division stated that it is actively reviewing its procedures and developing enhancements. Both divisions should be acknowledged for their commitment to strengthening governance and for management's support of these initiatives. Controls within the Aviation division operated effectively and aligned with established policies and procedures. However, in the Maritime division, we identified opportunities to enhance or further develop internal controls. These opportunities are summarized below and discussed in detail beginning on page six of this report. 1. (Low) Maritime does not have a formal documented process for project intake, prioritization, or approval within the Capital Improvement Plan. This makes it more susceptible to inconsistent decision making, undocumented or poorly supported capital planning decisions, and misalignment with strategic priorities. It is important to formalize and document Maritime's project prioritization process. As the Port continues to grow and expand its operations, a documented process will help assure alignment with the Port's strategic priorities and will also mitigate risk. We also identified opportunities to improve processes related to updating intake forms and explicit Capital Improvement Plan alignment with the Century Agenda Key Performance Indicators (KPIs) and Executive Director Priorities; these observations were communicated separately to Port management. Glenn Fernandes, CPA Director, Internal Audit Responsible Management Team Karen Goon, Deputy Executive Director Wendy Reiter, Managing Director, Aviation Eileen Francisco, Director AV Project Management Group Stephanie Jones Stebbins, Managing Director, Maritime Tin Nguyen, Chief Development Office, Maritime, Maritime Planning and Project Management Janice Zahn, Chief Engineer, Engineering General Services 3 Project Prioritization Background The Port generates more than $1 billion in annual operating revenues, incurs approximately $700 million in operating and maintenance expenses, and invests approximately $1 billion in long-term infrastructure projects annually. The Port is organized into three primary operating divisions: Aviation, Maritime, and the Economic Development Division. Capital projects are delivered through the Aviation and Maritime divisions. Assets previously acquired by the Economic Development Division have been reassigned to Maritime for Capital Improvement Plan (CIP) purposes, and each division prepares a CIP on a five-year planning cycle. Aviation The Aviation division's 2026-2031 CIP outlines planned investment at Seattle-Tacoma International Airport (SEA) and categorizes more than 81 projects into High, Medium, and Low priority levels, with an estimated project cost of approximately $7.5 billion. Major projects include the South Concourse Evolution, Concourse A Building Expansion, SEA Gateway, C Concourse Expansion, and the SEA Underground (STS) System Replacement. Aviation has maintained a project prioritization framework since 2016. In 2025, the division engaged external consultants to assess its capital governance structure and subsequently implemented several key process improvements, which were verified during the audit. Maritime The Maritime division delivers capital projects supporting multiple lines of business, including Cruise, Elliot Bay Fishing & Commercial Operations, Recreational Boating, Portfolio Management, and Marine Maintenance. Maritime's 2026-2030 CIP includes over 170 large capital projects with an estimated value of $610 million. Major ongoing projects include T117 Restoration, T91 NW Fender Replacement, T91 Berths 6 & 8, Fishermen's Terminal Maritime Innovation Center, Terminal 91 Uplands, P66 Shore Power, and T106 Customs and Border Protection Office and Facility Renovation. During the audit, Maritime stated that it is actively reviewing and updating its CIP procedures, with planned implementation later this year. Since the work remains in progress, we were unable to verify the revised procedures during the audit. 4 Project Prioritization Audit Scope and Methodology We conducted this performance audit in accordance with Generally Accepted Government Auditing Standards and The Institute of Internal Auditors' Global Internal Audit Standards. These standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained meets this requirement and supports our audit objectives. We used a risk-based, judgmental approach to select items for testing. As a result, the findings reflect only the items tested and should not be interpreted as representative of, or extrapolated to, the entire population. The period audited was April 2025, through April 2026 and included applying the following procedures to the Aviation and Maritime operating divisions for large capital projects over $300,000: Evaluate the Port's intake and prioritization processes and related internal controls • • • • Interviewed personnel to understand the intake workflow and prioritization methodology Reviewed a sample of seven Aviation projects and five Maritime projects from each division's Project Intake portal Conducted walkthroughs of CIP development to confirm key steps and controls were in place and reviewed key documents, including: o Aviation's CIP 2026-2031 o Maritime's CIP 2026-2030 o Aviation Investment Committee agendas and minutes o Commission meeting agendas and minutes (2025) Assessed alignment of CIP submissions with the Executive Director Priorities for 2026 and the Century Agenda KPIs Assess the accuracy, consistency, and governance of project scoring and approval • • • • Evaluated whether scoring assumptions were reasonable, documented, reviewed, and approved Reviewed a sample of seven aviation and four Maritime projects from each division's CIP Reperformed scoring for sampled projects to verify accuracy and consistency Traced sample projects from the CIP to scoring approval documentation Evaluate internal controls supporting risk monitoring and prioritization • • Reviewed the backlog/queue and assessed how new or emerging risks influence prioritization decisions Identified best practices, opportunities to enhance controls, and improve overall governance 5 Project Prioritization Schedule of Observations and Recommendations Rating: Low OPPORTUNITY Maritime does not have a formal documented process for project intake, prioritization, or approval within the Capital Improvement Plan (CIP). This makes it more susceptible to inconsistent decision making, undocumented or poorly supported capital planning decisions, and misalignment with strategic priorities. Intake Process: Our evaluation of Maritime's intake process found that sampled projects included completed intake forms with appropriate supporting documentation and met the criteria for Large Capital Projects. Each intake also had a documented disposition, and the projects aligned with the Century Agenda KPIs, Executive Director Priorities and broader strategic plans. Although the intake workflow is performed consistently in practice, Maritime does not have a documented Standard Operating Procedure (SOP) governing intake or prioritization process. The absence of formal procedures reduces standardization across multiple lines of business and may lead to errors, inefficiencies, or delays. Scoring and Approval Process: We determined that Maritime's scoring and approval process provides an informal structure for approvals; however, key governance elements are absent. The division does not have a formal scoring methodology, approval decisions are not documented in a standardized manner (relying instead on notes in the Division Review), and no written policies or procedures exist to govern scoring or approval activities. Key controls: We evaluated Maritime's project prioritization processes and identified several gaps related to the absence of written policies, procedures, and a formalized process framework. While an informal process exists, including risk monitoring, key process steps are not defined nor standardized. As a result, there is no documented guidance governing the overall CIP project prioritization process. These weaknesses reduce transparency, consistency and oversight, increasing operation risk. In addition, aging infrastructure and broader economic instability heighten the need for a formalized evaluation, prioritization, and approval framework to effectively mitigate emerging risks. Recommendations: To enhance transparency and accountability, Maritime should develop a formalized CIP governance framework, including: a documented project intake process; a standardized scoring methodology; formal approval requirement; and end-to-end policies and SOPs outlining roles, responsibilities, scoring criteria, and documentation standards. 6 Project Prioritization Management Response and Action Plan Maritime management acknowledges this low audit finding and is in the process of strengthening our CIP governance structure and documentation with SOPs for planning and CIP development. During our annual Maritime capital planning, we utilize a formal intake process to gather project needs across the division. This intake process has been in use for small projects (below $300K) since 2018 and for large projects ($300K+) since 2022. Although the intake process has been formalized over the years, we recognize the need to document the process along with our CIP development process. We also agree with the need to strengthen our prioritization with consistent processes. Due to the multiple business lines and competing diverse needs across the Seaport, a scoring system for prioritization may not be appropriate for addressing this gap. As part of strengthening our CIP governance structure, we will evaluate and implement a prioritization process that best allocates highest needs with limited capital capacity. DUE DATE: 12/31/2027 7 Project Prioritization Appendix : Risk Ratings Observations identified during the audit are assigned a risk rating, as outlined in the table below. Only one of the criteria needs to be met for an observation to be rated High, Medium, or Low. Low rated observations will be evaluated and may or may not be reflected in the final report. Rating High Medium Low Financial/ Operational Impact Internal Controls Compliance Significant Missing or partial controls Non-compliance with Laws, Port Policies, Contracts Moderate Partial controls; Not functioning effectively Partial compliance with Laws, Port Policies Contracts Minimal Functioning as intended but could be enhanced Mostly complies with laws, Port Policies, Contracts 8 Public High probability for external audit issues and / or negative public perception Moderate probability for external audit issues and / or negative public perception Low probability for external audit issues and/or negative public perception Commission/ Management Requires immediate attention Requires attention Does not require immediate attention