Wednesday marked the last presentation Halifax’s auditor general Evangeline Colman-Sadd will make to HRM council. Her contract is up, and she’ll be moving on to greener pastures. Hopefully her replacement is as thorough as she has been, as the reports coming out of her office have been vital to the city’s operations over the years. Colman-Sadd, for example, was the person who revealed that the Halifax Regional Police lied to the Board of Police Commissioners about how quickly they were fixing the issues first raised by the auditor general’s 2016 report about the police department’s IT infrastructure and security.
Information security was back on the agenda Wednesday in the form of Colman-Sadd’s report to the city’s audit and finance committee. She gave an update on the state of the city’s IT security, and it is bleak. The AG found the HRM is quite vulnerable to IT attacks. In the public portion of the meeting, Colman-Sadd told the committee that the city’s physical IT spaces are good places for computers to live, but bad for security. This may be because, as she laid out later in her report, the IT department has not gone through the city’s infrastructure to determine where it is most vulnerable—instead, the department treats all of the city’s IT infrastructure as equally important. And the AG also found that the city’s IT department doesn’t even know what it would need to be safer from an attack. While the AG did say that the IT department has highlighted the risks and priorities to council, city staff have not done the work to make and implement plans to address those risks.
All in all, the HRM’s IT infrastructure is quite vulnerable. The IT department was mandated to do cyber security training, but as of February 2023 only one-third of the IT department has done the training. Councillors were also instructed to do the training, and 11 of 17 elected officials have not done it. The city also has 451 laptops that are just straight-up missing.
There was an in-camera portion of this report’s delivery that could’ve been full of good news, but the portion that was publicly discussed points to a city with massive IT vulnerabilities. After the AG’s report, mayor Mike Savage got a motion passed directing CAO Cathie O’Toole to come up with a plan to deal with this within four months.
Another notable thing about Colman-Sadd’s last day in chambers was when she updated the committee on how city staff have responded to her office’s recommendations. She told the committee that many of her audits—like the payroll audit, the sidewalk audit and the transit technology audit—still have some recommendations outstanding. She said city staff seem to have a hard time meeting her recommendations to establish performance measures—and since these are not dependent on large purchases or changing equipment, they should be easy to do and are very important, as performance measures turn numbers into “meaningful targets instead of statistics.”
In other news from the committee, city staff said the HRM has a surplus of $3.1 million that’s being put into an operational reserve, as is required by law. Operational reserves allow the city to make up shortfalls in existing initiatives or help fund new ones. Operational expenses can be generally understood as the day-to-day services provided by the city.
HRM’s business units (e.g. transit, police, fire) are in a $3.6 million deficit because the cost of fuel was $11 million more than expected last year. The shortfall is only $3.6 million because the city got $8 million to offset the cost of fuel from the provincial and federal governments. The unexpected cleanup from Hurricane Fiona also cost the city $4.5 million, and the RCMP charged the city an additional $675,000 for the exceptional service the Mounties provided this past fiscal year. Like that time they showed up to the press conference about how badly they screwed up the Portapique shooting and demonstrated the report’s accuracy by not reading the report they were there to answer questions about.
The city did make a bit of unexpected money this year. There was a one-time surplus of about $4 million due to accounting around pensions and the city being short staffed. Paid parking also helped the city recoup some costs.
In future years, the city will start to adopt the practice of climate-related financial disclosures. The cost of climate change is not systematically captured or predicted in the city’s financial outlook and planning, as there is no formal system to assess the financial risk posed by climate change. Now there is a process by which the city can disclose and plan for our climate vulnerabilities. This is one step in the process that will allow the HRM to be more adaptive to the changing climate caused by our reckless consumption of Earth’s natural resources.
