Our opinions are included in the respective entities's annual financial report and our opinions for the city and the park board were unmodified which means it's a clean opinion and it's the best opinion that can be issued. This means the financial statements are fairly presented and conform with applicable accounting standards.

I have just few questions regarding the recurring SOC1 finding. For example, this is a second year of the state auditor has reported the lack of SOC1 type two or SOC1 report for the convention center service organization. What specifically prevented the city from resolving the finding during 2025 and at what point would the city consider replacing the vendor if it cannot provide COC one report?

I think in some of these cases um there is action that has to be taken by the federal agency first and then once the federal agency takes action then you can go in and do the reporting and so I think what happened is that it got updated at the federal agency but the federal agency doesn't always notify the local agency that it's updated and ready and I think they had been checking back um but not as frequently as needed to be to be for the report to be done in that time.

Because accurate system inventories and effective access management are foundational controls that help city safeguard data, manage technology risks and ensure consistent IT governance all across departments.

We observed that the city's centralized software systems inventory is incomplete and does not fully capture all the soft software and systems related to information used across departments.

I think the probably the bigger challenges we have and this gets at the self-reporting nature of it um is uh web-based software or there are also tools that people can download and install uh that do not require uh elevated access on the computer and and so if it's free software of that nature, it's very difficult for us through uh the normal sort of monitoring of what's happening on the computer to be able to uh understand what that is.

To answer your question we are moving forward with um contracting with Govramp. Uh that's moving forward in uh the next council cycle or two. So um that will afford some additional protections. In addition uh as as CIO Cameron had uh specified, we have enhanced our RFP process to include requirements for uh the sock 2 type 2 be part of that RFP. So captured as part of the contract.

Minneapolis continues to rely on Shot Spotter alerts for police and emergency response. Yet, the city lacks independent mechanisms to verify the accuracy of those alerts, evaluate whether they meaningfully improve public safety, or ensure that their use aligns with city policies and community expectations.

The reason why I want to highlight this is because those locations are data driven uh approximately based on volume. Uh and that means that they do not align with the neighborhood. That means it crosses through communities uh which is of course significant when you're trying to compare data because there isn't a clean comparison even within the community itself.

What I am commenting on is uh we didn't see independent effort by the city for validating that information.

Something that really strikes me is is this conversation about not knowing where all the sensors are. That scares me. um that that here at the city we don't know where all of the shot spotter sensors are, but we're making the argument that the sky will fall without Shot Spotter. That seems really inconsistent to me.

I'm not seeing a reason to renew that contract with what we see in front of us today. Um we see some recommendations on how we might be able to independently verify the um efficacy of this technology for the the stated safety goals. Um it's going to be a really high bar to clear for me to actually see how management responds to uh identifying that independent uh performance of this of this technology.

While Minneapolis does not use certain private systems that have raised regional concerns, such as Flax Safety's license plate reader systems, the public's reaction to those systems and more recently to questions about federal access during Operation Metro Surge underscores a growing community expectation. Surveillance technologies must operate within clear, consistent, and transparent safeguards.

The audit states that the auditor office requested but was unable to obtain a comprehensive list of data sharing agreement or MO use with federal law enforcement agencies. Does such a comprehensive inver inventory currently exist? If not, how can the city be confident that surveillance data is not being shared outside established authorization and oversight processes?

It is a policy that we did not assess whether or not it it is sufficient. We comment that it was less updated in 2002 and there have been changes in the technology landscape since then.

It feels to me that, you know, a a a records management policy from 2002 there's certainly is not going to reflect the current technology climate. Um it seems that we should have a similar um refresh on how we think about these technologies at least from that kind of maybe maybe that overly simplified three-part framework is not sufficient but something that tries to capture um a comprehensive a policy approach to these technologies because I I feel like that's a big gap here.

Chair Payne, I really don't have much to say other than I would request that the audit committee uh move forward with this request to our office. We are willing to take on this work. I would however ask that we target 2027 and we build it into our audit plan in 2027.