Orange County 2019-2020 - California Grand Jury Reports

From the annual report

The consolidated year-end volume. The individual investigations it contains are listed separately below.

📑 Year-End Report

View the full annual report (PDF)

The full consolidated volume; individual reports are listed below.

Individual reports (8)

September 21, 2020 — The Transportation Corridor Agencies – Are They Taking Their Toll on Orange County?*

189 pages 14 findings 19 recommendations

Quick View Full Details →

Findings & Recommendations 14 findings

F1: implication that the San Joaquin Hills Transportation Corridor The SJHTCA has completely fulfilled its original Agency (SJHTCA) is involved in planning efforts outside of its mandate to plan, finance and build SR 73 yet it scope is unfounded. All projects undertaken by the SJHTCA are continues to involve itself in future planning efforts, well within its legal authority. some of which are probably outside the purview with its charter. State law authorizes SJHTCA to fund, plan, acquire and construct major thoroughfares and bridges in Orange County (Government Code section 66484.3). All roads planned or constructed by the SJHTCA to date are major thoroughfares expressly contemplated by the Joint Exercise of Powers governing the SJHTCA. Additional widenings and construction of interchanges along the 73 Toll Road have been and will continue to be implemented based on traffic demands and approval by the Agency's Board of Directors comprised of elected officials. All planning activities undertaken by the SJHTCA are within its legal authority; therefore, the SJHTCA wholly disagrees with the Grand Jury's Finding. (Response Code 2) The Finding is erroneous and costs should reflect an accounting SJH

F2: perspective on appropriate allocations. Some budget cost allocations burden SJHTCA with costs not associated with an agency that has The length of the road does not always equate to the driver or fulfilled its mandate, such as Strategic Planning the benefit associated with the cost and reliance on this basis and Advocacy. Based on relative road lengths, would ignore reasonable methodologies to allocate costs. SJHTCA is allocated more than its share of Budget allocations are reviewed and adjusted annually based on common TCA costs, reducing its ability to retire its the costs and associated activities included in the budgets debt. adopted by each Agency's Board of Directors. Costs directly related to each Agency are charged entirely to that Agency and costs incurred on behalf of both Agencies are allocated between the Agencies based on the estimated benefit to each Agency. Depending on the type of activity, allocation factors may be based on the number of transactions and other operational metrics (e.g., number of facilities, equipment components, labor, etc.). The SJHTCA wholly disagrees with this the Grand Jury Finding. (Response Code 2) 1Public agencies are required to respond to the findings and recommendations of Grand Jury reports within 90 days. Response Code 1 = TCA agrees with the finding. Response Code 2 = TCA disagrees wholly or partially with the finding. A response specifying the portion of the finding that is disputed and an explanation of reasons must be provided. Responses to Findings | 2 TCA Response and Response Code1 Grand Jury Finding Agency The F/E wholly disagrees with this Grand Jury Finding. Similar to F/E

F3: transportation plans throughout the State of California, the bulk of The F/ETCA has fulfilled the bulk of its original investment is slated for improvements to existing facilities. This is mandate to plan, finance and build the SR 133, not an undertaking that should be easily dismissed. 241, 261 transportation corridor network. Only the SR 91 to SR 241 connector and in compliance The design and initial construction of the 133, 241 and 261 Toll with the approved Alternative 22 to the SCTRE Roads was completed to accommodate planned growth and report, the termination of the link between SR 241 provide alternative routes to existing highways and arterials. and I-5 remain to be completed. Additional widenings and construction of interchanges along The Toll Roads were always contemplated and will be constructed based on traffic demands and subject to approval by the Board of Directors. The absence of these widenings and interchange improvements would 1) necessitate higher toll rates to maintain high levels of service and 2) negatively impact Interstate 5, Interstate 405, State Route 55 and local city roads. Fortunately, the Agency's financial model allows for these improvements to be made without strain on tax dollars or the incurrence of additional debt. Therefore, the F/ETCA wholly disagrees with the Grand Jury's Finding, which implies that there is no merit or effort involved with improving existing facilities. (Response Code 2) TCA wholly disagrees with this Grand Jury Finding as it is Joint

F4: inaccurate in citing the Agencies current efforts and legislative TCA has been and continues to be involved authority. The Grand Jury report contains references to aspects of in projects, such as the I-5 HOV and HOT studies that were completed well in advance of its report being lanes, toll road enhancements, bike lanes, finalized. landscape maintenance, which may be considered beyond its original and currently All projects undertaken by the F/ETCA and SJHTCA were and legislated mandate. are well within legal authority and also meet the requirements set forth under state and federal environmental laws. State law authorizes both Agencies to develop major thoroughfares and bridges in Orange County (Government Code section 66484.3). The Grand Jury report does not recognize requirements for analyzing transportation projects. State and federal laws require project proponents (including TCA) to consider and study a wide range of project alternatives, which is evidenced in the many Environmental Impact Reports and Environmental Impact Statements the Agencies' Boards of Directors have undertaken over the years. The SJHTCA and F/ETCA wholly disagree with the Grand Jury's Finding. (Response Code 2) 1Public agencies are required to respond to the findings and recommendations of Grand Jury reports within 90 days. Response Code 1 = TCA agrees with the finding. Response Code 2 = TCA disagrees wholly or partially with the finding. A response specifying the portion of the finding that is disputed and an explanation of reasons must be provided. Responses to Findings | 3 TCA Response and Response Code1 Grand Jury Finding Agency TCA wholly disagrees with this Grand Jury Finding. TCA works in Joint

F5: close partnership with the Orange County Transportation Authority With the exception of the repayment of its (OCTA) and the California Department of Transportation accumulated debt, there appears to be little (Caltrans) to advance transportation improvements. This is if anything in the matter of highway demonstrated by the universal support for Alternative 22 and the planning, construction, or any county advancement of the 241/91 Express Connector Project as part of transportation activities the TCA can do a suite of projects to improve State Route 91. While the skeletal that is not already being accomplished by structure of the 73, 133, 241 and 261 Toll Roads (accounting for OCTA and/or Caltrans. 20 percent of Orange County's highway system) has been built, capacity and interchange improvements are still anticipated. TCA's involvement, partnerships and efforts to improve existing facilities and construct new facilities like the 241/91 Express Connector are done in collaboration with OCTA and Caltrans. This model has been hugely successful in delivering regional transportation solutions - part of what makes Orange County a great place to work and live. TCA's management of incurred debt supports delivery of these improvements without the use of federal, state or sales tax funding. The investors who purchased TCA's bonds have no ability to seek repayment from any governmental entity or by assessing taxes; security is solely from toll revenue and Development Impact Fees. TCA's financings are the model for non-recourse start-up toll road financings that have been executed across the country to finance highway infrastructure on both a public and a private basis. Even during times of economic uncertainties - and heightened by the COVID-19 pandemic - TCA remains poised to continue as two of the nation's most successful toll facilities utilizing non-recourse financing. Given the unique contributions, authorities and ability of the SJHTCA and F/ETCA to play an important role in delivering needed transportation projects, the Agencies would cite the opportunity for continued partnership with OCTA and Caltrans and wholly disagree with the Grand Jury's Finding. (Response Code 2) 1 Public agencies are required to respond to the findings and recommendations of Grand Jury reports within 90 days. Response Code 1 = TCA agrees with the finding. Response Code 2 = TCA disagrees wholly or partially with the finding. A response specifying the portion of the finding that is disputed and an explanation of reasons must be provided. Responses to Findings | 4 TCA Response and Response Code1 Grand Jury Finding Agency TCA wholly disagrees with this Grand Jury Finding as it misstates Joint

F6: readily available information. TCA receives payment of Development Impact Fees for new construction per the Major Thoroughfare Development Impact Fees (DIF) are one-time fees paid by and Bridge Fee Program, which remains in effect developers on new development only in the "areas of benefit" until all TCA bonds have been fully repaid, requiring surrounding The Toll Roads. Orange County residents and corporations to continue to pay the fees, which increase every year. TCA built The Toll Roads in advance of collecting the fees by issuing toll revenue bonds that are paid back with tolls and DIFs. When developers build projects, they have a responsibility to underwrite some of the cost of the infrastructure that is required to support their projects. Water lines, sewer lines, schools and roads are all part of the infrastructure needed. Thus, DIFs are paid by developers to ensure they pay for the infrastructure from which they benefit, and DIFs ensure that developers' projects have the infrastructure support they need to succeed. TCA's structure for DIFs and the annual escalation was created in partnership with developers - most notably the Irvine Company - understanding the value transportation infrastructure would have for their business and Orange County's quality of life. As the Grand Jury's report incorrectly identifies who pays the fees and ignores TCA's ability to adjust the fees, TCA wholly disagrees with this Finding. (Response Code 2) TCA wholly disagrees with this Grand Jury Finding and it is Joint

F7: unclear how it pertains to the TCA's. However, the Grand Jury's While the idea of using tolls to fund the statement misrepresents the fact there are no "free" roads. The development of new state highway in California's only debate is how best to pay for the cost of constructing, historically free highway system enabled maintaining and improving them. construction of the roads, toll lanes are now instead being used to increase the average User-based fee models such as tolling have proven extremely speed of HOV lanes to meet the federal mandate. effective around the country and the world as a sustainable funding source. Furthermore, the need for user-fee models will undoubtedly grow as vehicles move away from fossil fuels. The report is somewhat accurate in noting the ability of High Occupancy Toll lanes to improve the performance of the entire highway by encouraging carpools through discounts; moving vehicles from the congested general purpose lanes; and improving travel times for transit while also providing funding for the maintenance of the roadway and transit improvements. However, TCA wholly disagrees with the Grand Jury's Finding as it fails to recognize transportation needs and viable solutions. (Response Code 2) Public agencies are required to respond to the findings and recommendations of Grand Jury reports within 90 days. Response Code 1 = TCA agrees with the finding. Response Code 2 = TCA disagrees wholly or partially with the finding. A response specifying the portion of the finding that is disputed and an explanation of reasons must be provided. Responses to Findings | 5 TCA Response and Response Code1 Grand Jury Finding Agency TCA wholly disagrees with this Grand Jury Finding. The Grand

F8: Joint Jury report contains no evidence to support this and it does not The TCA employs political and public relations acknowledge TCA's authority and every transportation consultants as a promotional tool to help broaden agency's state and federal obligations to study potential its scope of activities (to include advertising aimed transportation solutions and keep the affected communities at improving its public image) that would extend informed. beyond its legislated boundary limits. Like other agencies and public entities, TCA utilizes contracted services to execute work and directed efforts approved by its two Boards of Directors; and in alignment with the Agencies' authority. Outreach and communications are an essential component of engaging the community and educating drivers and this has been a critical area of work requiring a team of dedicated TCA in-house staff and professional consultants; therefore, TCA wholly disagrees with the Grand Jury's Finding. (Response Code 2) TCA wholly agrees with this Grand Jury Finding. TCA agrees and Joint

F9: thanks the Grand Jury for acknowledging our talented in-house TCA has a capable in-house Communications Department. The work highlighted by the Grand communications staff as evidenced by the Jury is yet one example of all TCA staff and their capabilities to excellent COVID-19 Communications Plan. perform and complete the work required and approved by the Joint Boards of Directors. The SJHTCA and F/ETCA agree with the Grand Jury's Finding. (Response Code 1) 1 Public agencies are required to respond to the findings and recommendations of Grand Jury reports within 90 days. Response Code 1 = TCA agrees with the finding. Response Code 2 = TCA disagrees wholly or partially with the finding. A response specifying the portion of the finding that is disputed and an explanation of reasons must be provided. Responses to Findings | 6 TCA Response and Response Code1 Grand Jury Finding Agency TCA wholly disagrees with this Grand Jury Finding as it is Joint

F10: inaccurate and misleading. Its conclusion fails to recognize a Not all material presented in TCA committee common practice used by regional agencies and state/federal meetings is available in the Board Meeting packet, legislative bodies. resulting in an incomplete presentation to the Board and public. TCA has an extensive and deliberate Board Member Committee structure in place where staff present business items for discussion and consideration in detail. The Board Committee provides thorough oversight through clarifying questions and also provides specific direction on items presented. The Committee then makes the recommendations to bring items to the full Boards of Directors for consideration and voting for approval/ denial. As Committees of the Boards are comprised of nearly half of the two Boards of Directors, this provides Board Members a defined and structured process to receive and thoroughly analyze and understand the Agencies' various business items. Staff also offer briefings to all Board Members who have questions about any item. No final decisions are made at the Committee level and all materials presented at Committee and Board Meetings are available to the public per the Brown Act. Furthermore, as noted by the Grand Jury, the Agencies have implemented changes aimed at increasing public involvement in Committee and Board meetings. All Committee and Board Meetings are now broadcast live and allow for the public to submit comments ahead of the meetings for the TCA Clerk of the Board to read aloud. These additional measures are aimed at increasing transparency and public participation. The SJHTCA and F/ETCA wholly disagree with the Grand Jury's Finding, as it does not recognize a well- organized and common practice. (Response Code 2) 1Public agencies are required to respond to the findings and recommendations of Grand Jury reports within 90 days. Response Code 1 = TCA agrees with the finding. Response Code 2 = TCA disagrees wholly or partially with the finding. A response specifying the portion of the finding that is disputed and an explanation of reasons must be provided. Responses to Findings | 7 TCA Response and Response Code1 Grand Jury Finding Agency TCA wholly disagrees with this Grand Jury Finding and the report

F11: Joint lacks evidence supporting this unfounded accusation. All TCA Recently, much of the planning is being performed actions are consistent with its legislative authority and the by consultants and TCA staff, who have a financial operable Joint Powers Agreements. Detailed planning work at all interest in seeing the TCA continue beyond its government agencies is done by staff and consultants and the original mandate, and out of view of many of the TCA results and/ Board Members and the public, thus creating a or recommendations are presented to the Boards of Directors for conflict of interest issue. consideration and direction. Final reports are made available to Board Members and the public accordingly. The citation that this common practice creates a conflict is without merit. Similar to other agencies and public entities, TCA contracts with professional consultants with expertise to execute specific scopes of work that are approved by its Boards of Directors. During the consultant's term of services, staff provides updates on work product to the applicable Board Committee throughout the fiscal year and to the full Boards of Directors on at least an annual basis. This is evidenced in the robust annual budget planning process the Agencies undertake each year that includes several workshops, Committees and Board of Directors' input on annual initiatives and fiscal year budget. The SJHTCA and F/ETCA wholly disagree with the Grand Jury's Finding. (Response Code 2) TCA wholly disagrees with this Grand Jury Finding. The Grand

F12: Joint Jury report includes no evidence supporting this and the Grand Elected officials who have voiced opposition to the Jury's lack of recognition that many who have voiced support of TCA have been subjected to negative information TCA, as well as TCA staff and consultants, have also been campaigns by TCA proponents. subjected to negative Information. While the Grand Jury report cites allegations by some who believe they came under attack due to their opposition of TCA, there have been personal attacks on TCA Board Members, staff, consultants and against leaders of trade organizations and business groups that support the Agencies. These attacks appear to relate to a campaign by a contracted consultant citing a strategy to "...increase public antagonism towards the agency; its' Board of Directors within their home cities, taxpayers and even some environmental groups". This statement is supported by the proposal document (attachment 3 to the cover letter) submitted by the City of San Clemente's public relations firm along with posted social media attacks and other visible activities pointing to execution of the proposed plan. Excerpts from the proposal include: "We envision running this engagement like a "campaign", . designed specifically at moving stakeholder sentiment against TCA's plans in and around San Clemente so that various projects are studied and litigated for decades." "Based on our campaign and project issues experience, engagement will include several communications tactics such as community meetings and forums, direct mail, social media, paid advertising, third-party validators, editorial board meetings, etc. The use of negative personal attack tactics is disheartening to the SJHTCA and F/ETCA Boards of Directors and the Boards do not condone this type of activity. Since the SJHTCA and F/ETCA do not authorize the use of such methods, the Agencies wholly disagree with the Grand Jury's Finding. (Response Code 2) 1Public agencies are required to respond to the findings and recommendations of Grand Jury reports within 90 days. Response Code 1 = TCA agrees with the finding. Response Code 2 = TCA disagrees wholly or partially with the finding. A response specifying the portion of the finding that is disputed and an explanation of reasons must be provided. Responses to Findings | 8 TCA Response and Response Code1 Grand Jury Finding Agency This Finding is inaccurate. The Grand Jury report does not Joint

F13: contain information supporting this finding and SCAG has not It appears that neither the F/ETCA nor the SJHTCA communicated any concerns to TCA regarding the MOU. Such has complied with April 5, 2001 MOU signed by an allegation should be substantiated with fact or at a minimum each of these agencies with SCAG regarding their confirmation by a party to the agreement. agreement to collectively construct approximately 150 additional lane miles of highway (per section Contrary to the Grand Jury's statements, the Agencies' MOU with 1.1, 1.2, 1.3 Recitals, and following) over the SCAG requires that it implement an Average Vehicle Occupancy ensuing span of the agreement. (AVO) Monitoring Program on The Toll Roads and submit that report annually to SCAG for concurrence and identification of the following year's AVO goal. The Agencies have complied with the terms of the MOU and have conducted and submitted annual AVO Monitoring Reports to SCAG. The Agencies are in full compliance with the terms of the MOU; therefore, the SJHTCA and F/ETCA wholly disagree with this Finding. (Response Code 2) TCA wholly disagrees with this Grand Jury Finding.

F14: Joint It was observed that some elected BoD members TCA provides a New Board Member Orientation to each Director showed limited knowledge of the agreements and when they are appointed to one of TCA's Boards of Directors. codes that govern the creation and operation of their Board Members understand TCA's legislative authority and operable agency possibly contributing to the potential for poor Joint Powers Agreements. They are kept informed about Agency management and/or leadership. activities, issues and financial standing. This information allows the Boards of Directors to establish policy, exercise appropriate oversight and assign strategic direction while allowing staff management of daily operations. During the New Board Member Orientation, Board Members are presented with a reference binder that contains an introduction to the Agencies and its Boards of Directors; an overview of the Agencies' organization, departments and points of contact; the current Board approved fiscal year initiatives; reference maps that illustrate The Toll Road network within or adjacent to member agency jurisdictions; the Agencies' Joint Exercise of Powers Agreement; a historical timeline of the Agencies since inception; the Boards approved fiscal year budget; independent auditors' financial statements for each of the Agencies; Appendix C of the Agencies' Administrative Code that identifies the Agencies' Board Committees; Appendix F to the Agency Administrative Code of Conduct; and information on the Major Thoroughfare & Bridge Fee Program and Development Impact Fees program. In addition to the New Board Member Orientation, staff continually works with the Boards of Directors through one-on- one briefings, Committee meetings, and input and review of fiscal year initiatives and budgets to complete the required activities. Given the breadth of Board Member education and involvement, the SJHTCA and F/ETCA wholly disagree with the Grand Jury's Finding. (Response Code 2) 1 Public agencies are required to respond to the findings and recommendations of Grand Jury reports within 90 days. Response Code 1 = TCA agrees with the finding. Response Code 2 = TCA disagrees wholly or partially with the finding. A response specifying the portion of the finding that is disputed and an explanation of reasons must be provided. Responses to Findings | 9 Responses to Recommendations TCA Response and Response Code2 Grand Jury Recommendation Agency This Grand Jury Recommendation is not warranted and SJH

Additional Recommendations 10

Not linked to specific findings.

R9: the Joint Boards of Directors. Based on future TCA Boards Every elected member of the BoD of each JPA as discussion, a response will be provided to the Grand Jury by a condition of membership on that board should March 26, 2021 on whether this Recommendation warrants be required to read and acknowledge having done implementation. so the three governing documents regarding the creation and operation of the JPAs (as cited in the As detailed in the response to Finding 14, a new Board Member "Mission Creep" paragraph above). (F1, F2, F3, Orientation is provided to each Director when they are

R11: N/A Board of Supervisors required response. (Response Code N/A) While it is recognized that the Orange County Board of Supervisors (BoS) has representatives on the BoD of each of the two JPAs cited herein, the BoS should, as an entire panel, review the findings of this report and take appropriate action to investigate and remediate the issues raised, to include a directive aimed at reducing the total financial burden placed on the county citizenry and the users of the four state highways within Orange County. (F1, F2, F3,

R12: TRANSPORTATION CORRIDOR AGENCIES COMPLIANCE WITH CONTRACT K000983 STRATEGIC RESEARCH AND STAKEHOLDER OUTREACH CONSULTING SERVICES SCHEDULE OF AUDIT FINDINGS AND RECOMMENDATIONS Cause: With three individual signatories reviewing invoices, the design of the internal control did not clarify which of the signatories was responsible for verifying the mathematical accuracy and billing rates of the entire invoice. Given the high volume of time entries included on the time summary, certain reviewers were checking billing rates, the existence of duplicate billings and mathematical accuracy of the invoice on a sample basis. Further, Agency management did not obtain billing rates for Subconsultants from the Consultant to verify that the Subconsultant rates included in the time summary were approved. The contract does not list Subconsultant rates by position, only Consultant key personnel. In addition, Agency management did not obtain billing rates for all non-key Consultant personnel. Without such billing rates, the Agency management review of invoices would not have a baseline of comparison as part of their internal control process. Lastly, Agency management did not review the invoices for uniformity in presentation of individual time entries. Effect: As a result of the deficiencies in the design of the Agency management review, extended cost calculation errors were noted in eight of the 50 invoices, that resulted in a net underbilling of ($2,690); billing rate errors were noted in 36 of the 50 invoices, that resulted in a net underbilling of ($13,232); and duplicate billing errors were noted in 11 of the 50 invoices, that resulted in a net overbilling of $10,161. The duplicate billings and errors in billing rates and extended cost calculations resulted in a cumulative net underbilling of $5,761. Further, without uniformity in presentation of distinct individual time entries, billing errors may occur. Recommendations: We recommend that Agency management amend their policies and procedures to clarify the specific roles and responsibilities of the Agency Technical Representative, Contract Administrator and Accounts Payable Staff when reviewing time and materials contracts. The summation of the individual reviews should be comprehensive enough to ensure that invoices are mathematically accurate, billing rates are supported by agreed upon rates and that invoices are reviewed for potential duplicate billings. The use of excel programs and data analytics may be an efficient and effective means for testing mathematical accuracy and detecting errors in billing rates and duplicate time entries. Also, we recommend the Agency include in the Contract the billing rates and names of all Consultant and Subconsultant personnel (key and non-key personnel) included on monthly invoices. Lastly, we recommend that Agency management design the time summary such that an individual time entry is unique to one personnel so that Agency management can review the hours for accuracy, verify billings rates, recalculate extended cost and ensure that activities performed are allowable. Views of Responsible Officials and Planned Corrective Actions All invoiced hours were clarified and confirmed with the Consultant on a regular basis. Work efforts and tasks were checked and verified with the Consultant to match level of effort with the current work efforts and assignments. The Agency's Payment Processing Overview documentation has been updated to better document the Agency's invoicing procedures. Specific roles and responsibilities of the Technical Representative (TR), Contract Administrator (CA) and Accounts Payable (AP) staff have been clarified through this update. The Agency also has implemented a formal kick-off meeting for contracts that will involve a more complex review for invoices. At minimum, participants will include the TR, CA and AP clerk. It should be noted that most Agency contracts do not encompass complex invoicing issues such as multiple tasks, subtasks and subcontractors. (Continued)

R13: TRANSPORTATION CORRIDOR AGENCIES COMPLIANCE WITH CONTRACT K000983 STRATEGIC RESEARCH AND STAKEHOLDER OUTREACH CONSULTING SERVICES SCHEDULE OF AUDIT FINDINGS AND RECOMMENDATIONS Billing rates were set with the original contract beginning in 2015. Some billing rate errors occurred as the result of administrative errors by Consultant staff when compiling entries into the time sheet used to prepare invoices submitted to the Agency. Additionally, some billing rate changes as a result of staff classification adjustments were made by the Consultant and not communicated immediately to the Agency. Following the Agency's own internal audit, modifications were made such that any changes to the billing rates must be communicated timely in writing from the Consultant to the Agency. With respect to the recommendation to include billing rates and names of consultant and subconsultant personnel, Agency contracts include consultant billing rates and classifications for time and material-based contracts, and in some instances the contract may include named personnel per classification. For contracts that include a large number of non- key personnel, including names of those individuals in the contract would require numerous amendments to the contract. The responsible TR will continue to periodically request a list of relevant personnel and classifications from the consultant and submit the list to the CA for retention within the file. In general, subcontractor billing rates are administered by the prime consultant and not stated in the Agency contract. However, in some instances subcontractor billing rates are stated in the contract. In these occurrences Agency staff reviews the rates in accordance with the Agency's Payment Processing Overview Procedures. (Continued)

R14: TRANSPORTATION CORRIDOR AGENCIES COMPLIANCE WITH CONTRACT K000983 STRATEGIC RESEARCH AND STAKEHOLDER OUTREACH CONSULTING SERVICES SCHEDULE OF AUDIT FINDINGS AND RECOMMENDATIONS

R15: TRANSPORTATION CORRIDOR AGENCIES COMPLIANCE WITH CONTRACT K000983 STRATEGIC RESEARCH AND STAKEHOLDER OUTREACH CONSULTING SERVICES SCHEDULE OF AUDIT FINDINGS AND RECOMMENDATIONS We noted the following exceptions: 25 of the 50 invoices were not invoiced on the first day of each month for the preceding month of

R16: TRANSPORTATION CORRIDOR AGENCIES COMPLIANCE WITH CONTRACT K000983 STRATEGIC RESEARCH AND STAKEHOLDER OUTREACH CONSULTING SERVICES SCHEDULE OF AUDIT FINDINGS AND RECOMMENDATIONS Views of Responsible Officials and Planned Corrective Actions The Agency's Payment Processing Overview documentation has been updated to better document the Agency's invoicing procedures. Specific roles and responsibilities of the Technical Representative (TR), Contract Administrator (CA) and Accounts Payable (AP) staff have been clarified through this update. The Agency also has implemented a formal kick-off meeting for contracts that will involve a more complex review for invoices. At minimum, participants will include the TR, CA and AP clerk. It should be noted that most Agency contracts do not encompass complex invoicing issues such as multiple tasks, subtasks and subcontractors. In response to specific items in this finding: The majority of the issues appeared earlier in the contracting period. This contract encompassed

R17: TRANSPORTATION CORRIDOR AGENCIES COMPLIANCE WITH CONTRACT K000983 STRATEGIC RESEARCH AND STAKEHOLDER OUTREACH CONSULTING SERVICES SCHEDULE OF AUDIT FINDINGS AND RECOMMENDATIONS

R18: TRANSPORTATION CORRIDOR AGENCIES COMPLIANCE WITH CONTRACT K000983 STRATEGIC RESEARCH AND STAKEHOLDER OUTREACH CONSULTING SERVICES SCHEDULE OF AUDIT FINDINGS AND RECOMMENDATIONS Views of Responsible Officials and Planned Corrective Actions The dynamic nature of the VSI contract required immediate attention to matters as they arose. It should be noted that all changes, although not memorialized through a contract amendment, were directed and approved by the TR prior to payment through close coordination and verification with the Consultant. In all other instances, the responsible TR is required to notify the CA of all agreed upon contract modifications (e.g., billing rates, additional subcontractors, etc.) for inclusion in a written modification approved by both parties. The Agency Contracts and Procurement staff will continue to disallow invoiced items not formally incorporated into the contract. In most instances, Agency contracts do not include named personnel in billing rate tables, but instead typically include a table of classifications with billing rates. The responsible TR will continue to periodically request a list of relevant personnel and classifications from the Consultant to validate approved billing rates and classifications, and notify the CA of any changes.

R19: 111 PACIFICA, SUITE 300 IRVINE, CA 92618 HALL&COMPANY Certified Public Accountants, Inc. (949) 910-HALL (4255) FAX (949) 910-4256 TAX, FINANCIAL AND MANAGEMENT CONSULTING SERVICES WWW.HALLCPAS.COM August 29, 2019 Amy Potter Chief Financial Officer Transportation Corridor Agencies 125 Pacifica, Suite 100 Irvine, CA 92618-3304 Independent Accountant's Report on Applying Agreed-Upon Procedures We have performed the procedures enumerated below, which were agreed to by the Chief Financial Officer of Transportation Corridor Agencies on the Accounts Payable (AP) information of two independent contracts; Curt Pringle and Associates (K001162) and Venture Strategic, Inc. (K000983) from July 2017 to March 2019 and December 2015 through January 2019 respectively, included in the accompanying information provided to us by management of Transportation Corridor Agencies. Transportation Corridor Agencies is responsible for the AP information of Transportation Corridor Agencies from July 2017 to March 2019 and from December 2015 through January 2019 respectively, included in the accompanying information provided to us by management of Transportation Corridor Agencies. The sufficiency of these procedures is solely the responsibility of the party specified in this report. Consequently, we make no representation regarding the sufficiency of the procedures enumerated below either for the purpose for which this report has been requested or for any other purpose. Procedure Performed and Results Procedures:

June 26, 2020 — Grand Jury 2019-2020 Maternal Health Care While Incarcerated

35 pages 26 findings 21 recommendations

Quick View Full Details →

Findings & Recommendations 26 findings

F1: The 2018-2019 Grand Jury recommended that four interview cubicles be constructed by the Orange County Sheriff’s Department at the Intake Release Center. The Orange County Sheriff’s Department agreed with that recommendation. However, as of the date of the publication of this report, the construction of the four cubicles had not been completed.

Related Recommendations (1)

R1: The Orange County Grand Jury recommends that the Orange County Sheriff’s Department be monitored for the completion of the reconfiguration on the screening area at the Intake Release Center by newly scheduled date of December 2020. (F1)

F2: The Statement of Booking Officer form does not question if an arrestee is or could be pregnant when processed into the Orange County Jail, potentially resulting in inmates receiving the wrong care and/or placement.

Related Recommendations (1)

R2: The Orange County Grand Jury recommends that the Correctional Health Services amend the Statement of Booking Officer form to include a question about pregnancy when processing female arrestees into the Orange County Jail. (F2)

F3: Taking blood pressure when an arrestee is handcuffed behind the back could result in an inaccurate reading, potentially resulting in improper care and/or placement.

Related Recommendations (1)

R3: The Orange County Grand Jury recommends that taking inmate’s blood pressure readings with their body in a position that will result in accurate readings thereby leading to proper placement and care. (F3)

F4: All the printed reports of pregnant inmates’ electronic medical records were found to be incomplete with missing data.

Related Recommendations (2)

R4: The Orange County Grand Jury recommends that Correctional Health Services provide training for jail staff to properly and accurately complete required forms and to audit the completion of these forms to assure accuracy. This will increase inmate safety and reduce County potential liability stemming from incomplete inaccurate records. (F4, F10)

R11: The Orange County Grand Jury recommends that pregnant inmates’ weight be consistently tracked to assure they are receiving adequate nutrition. (F4)

F5: Correctional Health Services routinely performed pregnancy testing during the intake booking process.

F6: Correctional Health Services consistently issued pink tags (wristbands) during the intake booking process identifying inmates as pregnant or possibly pregnant.

F7: Although pregnant inmates were correctly identified by Correctional Health Services during the intake booking process with a pink tag (wristband), they were not consistently assigned to a low bunk or a low tier as is required for pregnant inmates.

Related Recommendations (2)

R5: The Orange County Grand Jury recommends that pregnant inmate’s records be audited to ensure that they receive the accommodations to which they are entitled to. (F7, F11)

R21: The Orange County Grand Jury recommends that all jail personnel be regularly trained on policies for pregnant inmates and that activities be supervised to ensure compliance. (F7, F8, F11, F12) RESPONSES The following excerpts from the California Penal Code provide the requirements for public agencies to respond to the Findings and Recommendations of this Grand Jury report: §933 (c) No later than 90 days after the grand jury submits a final report on the operations of any public agency subject to its reviewing authority, the governing body of the public agency shall comment to the presiding judge of the superior court on the findings and recommendations pertaining to matters under the control of the governing body, and every elected county officer or agency head for which the grand jury has responsibility pursuant to Section 914.1 shall comment within 60 days to the presiding judge of the superior court, with an information copy sent to the board of supervisors, on the findings and recommendations pertaining to matters under the control of that county officer or agency head and any agency or agencies which that officer or agency head supervises or controls. In any city and county, the mayor shall also comment on the findings and recommendations. All of these comments and reports shall forthwith be submitted to the presiding judge of the superior court who impaneled the grand jury. A copy of all responses to grand jury reports shall be placed on file with the clerk of the public agency and the office of the county clerk, or the mayor when applicable, and shall remain on file in those offices. One copy shall be placed on file with the applicable grand jury final report by, and in the control of the currently impaneled grand jury, where it shall be maintained for a minimum of five years. 933.05. (a) For purposes of subdivision (b) of Section 933, as to each grand jury finding, the responding person or entity shall indicate one of the following: (1) The respondent agrees with the finding. (2) The respondent disagrees wholly or partially with the finding, in which case the response shall specify the portion of the finding that is disputed and shall include an explanation of the reasons therefor. (b) For purposes of subdivision (b) of Section 933, as to each grand jury recommendation, the responding person or entity shall report one of the following actions: (1) The recommendation has been implemented, with a summary regarding the implemented action. (2) The recommendation has not yet been implemented, but will be implemented in the future, with a timeframe for implementation. (3) The recommendation requires further analysis, with an explanation and the scope and parameters of an analysis or study, and a timeframe for the matter to be prepared for discussion by the officer or head of the agency or department being investigated or reviewed, including the governing body of the public agency when applicable. This timeframe shall not exceed six months from the date of publication of the grand jury report. (4) The recommendation will not be implemented because it is not warranted or is not reasonable, with an explanation therefor. (c) However, if a finding or recommendation of the grand jury addresses budgetary or personnel matters of a county agency or department headed by an elected officer, both the agency or department head and the board of supervisors shall respond if requested by the grand jury, but the response of the board of supervisors shall address only those budgetary or personnel matters over which it has some decision-making authority. The response of the elected agency or department head shall address all aspects of the findings or recommendations affecting his or her agency or department. (d) A grand jury may request a subject person or entity to come before the grand jury for the purpose of reading and discussing the findings of the grand jury report that relates to that person or entity in order to verify the accuracy of the findings prior to their release. (e) During an investigation, the grand jury shall meet with the subject of that investigation regarding the investigation, unless the court, either on its own determination or upon request of the foreperson of the grand jury, determines that such a meeting would be detrimental. (f) A grand jury shall provide to the affected agency a copy of the portion of the grand jury report relating to that person or entity two working days prior to its public release and after the approval of the presiding judge. No officer, agency, department, or governing body of a public agency shall disclose any contents of the report prior to the public release of the final report. (Amended by Stats. 1997, Ch. 443, Sec. 5. Effective January 1, 1998.)

F8: At the time of the Grand Jury’s visit to the Women’s Central Jail, inmates were not issued pink pants to identify them as being pregnant as is required by the current Clothing Identification system.

Related Recommendations (2)

R6: The Orange County Grand Jury recommends that pregnant inmates be consistently issued pink pants to accurately identify their classification. (F8)

F9: The Pregnant Inmate Information form does not include all of the required standards and policies governing pregnant inmates.

Related Recommendations (2)

R7: The Orange County Grand Jury recommends that the Pregnant Inmate Information Standards form be revised and updated to reflect jail standards and policies governing pregnant inmates to include an inclusive list of rights to which pregnant inmates are entitled. (F9)

R8: The Orange County Grand Jury recommends that female inmates be informed of their rights with respect to consenting and testing for alcohol and/or drugs and whether the test results will be kept confidential or if the results will be reported to the County of Orange Social Services Agency (F9)

F10: Medical care refusal acknowledgement forms were not correctly completed in that the signature line was blank with neither the inmate’s signature nor a staff notation of “refused” indicating that the inmate refused to sign the form.

Related Recommendations (1)

F11: Pregnant inmates were not consistently provided an extra mattress if pregnancy was > 26 weeks as required.

Related Recommendations (2)

R5: The Orange County Grand Jury recommends that pregnant inmate’s records be audited to ensure that they receive the accommodations to which they are entitled to. (F7, F11)

F12: There are irregularities with respect to enforcement of the newly implemented policy prohibiting the use of waist restraints on pregnant inmates.

Related Recommendations (1)

F13: Many inmates choose to launder their clothes in their cells between scheduled clothing exchanges.

Related Recommendations (2)

R9: The Orange County Grand Jury recommends that OCJ provide clean undergarments (i.e., underwear) for each day of the week for female inmates. (F13)

R10: The Orange County Grand Jury recommends that inmates be advised that the only way to reliably remove organisms that can cause disease from clothes is to use the institutional laundry. (F13)

F14: Once identified as pregnant, Correctional Health Services provides daily prenatal vitamins to inmates.

F15: Orange County Sheriff’s Department Food Services Unit has modified the standard diet for pregnant inmates to address their nutritional dietary needs.

F16: Dehydration is common among pregnant inmates in the Central Women’s Jail.

Related Recommendations (1)

R12: The Orange County Grand Jury recommends that educational materials be made available to all pregnant inmates relating to the importance of staying hydrated and the minimum recommended daily water intake during pregnancy. (F16)

F17: Individual units of water are not available for purchase at the jail commissary.

Related Recommendations (1)

R13: The Orange County Grand Jury recommends that individual units of water be available for purchase at the jail commissary. (F17)

F18: Based on the cases that were provided to the Grand Jury to review, the rate of Urinary Tract Infection among pregnant inmates in the Central Women’s Jail was as high as 65%.

Related Recommendations (1)

R14: The Orange County Grand Jury recommends that the Correctional Health Services take a proactive approach on establishing guidelines and recommendations for all female inmates that will help them avoid Urinary Tract Infections. (F18)

F19: Orange County Jail complied with ensuring that opioid dependent pregnant inmates have access to either a triage prescriber or to a prescriber on-call within 24-hours of all new bookings.

F20: Not all opioid-dependent pregnant inmates receive adequate discharge plans and linkage of services upon their release from jail.

Related Recommendations (1)

R15: The Orange County Grand Jury recommends that all opioid-dependent pregnant inmates receive adequate discharge plans and linkage to support services upon release from jail. (F20)

F21: Inmate Health Message Slip(s) were not consistently documented by Correctional Health Services with date and employee number.

Related Recommendations (1)

R16: The Orange County Grand Jury recommends that the Inmate Health Message Slip be “hard stamped digitally” (not hand-written or left blank) to ensure that procedures are being consistently followed and inmate health care needs are being addressed. (F21)

F22: Although male inmates have access to Patient’s Rights Advocates, female inmates do not have equal access to Patient’s Rights Advocates.

Related Recommendations (1)

R17: The Orange County Grand Jury recommends that female inmates have equal access to Patients’ Rights Advocates as the male inmates do. (F22)

F23: Contracted service providers are not aware of and do not have access to the Orange County Jail policies regarding the monitoring and securing of pregnant inmates.

Related Recommendations (1)

R18: The Orange County Grand Jury recommends that contracted service providers with the Orange County Jail be provided with policies regarding the monitoring and securing of pregnant inmates. (F23)

F24: Orange County Sheriff’s Department may be required to provide emergency medical care to pregnant inmates.

Related Recommendations (1)

R19: The Orange County Grand Jury recommends that the Orange County Sheriff’s Department conduct training that insures that all personnel are properly trained and certified to perform the type of health care, including childbirth, that they may be called on to perform. (F24)

F25: Health Care Agency contracts with one OB/GYN doctor to provide services at the Central Women’s Jail only two days a week.

F26: Although Correctional Health Services policy states that they “shall keep a list of all pregnancies and their outcomes” for inmates who were less than 20 weeks pregnant, Correctional Health Services did not track the outcomes for these pregnancies.

Related Recommendations (1)

R20: The Orange County Grand Jury recommends that all pregnancy outcomes occurring during incarceration be tracked. (F26)

March 16, 2020 — Grand Jury 2019-2020 Oc Recycling: Doing it the Right Way

28 pages 4 findings 3 recommendations

Quick View Full Details →

Findings & Recommendations 4 findings

F1: In nine of the ten cities investigated, the waste hauler has been the sole source provider to their respective city(s) anywhere from 39 to 72 years. Where there is an opportunity for service providers to compete, there is an opportunity for competitive bidding, which may result in improvements in cost and performance.

Related Recommendations (1)

R1: All cities and county entities that do not have a contract review process in place should establish one to ensure regular reviews of service contracts are performed and that contract terms are still relevant as legislative changes are enacted. Serious consideration should be given to shortening the length of contracts to facilitate opportunities for competitive bidding where feasible. (F1)

F2: The labeling on residential bins are not always legible or have comprehensive enough instructions laminated or otherwise made a part of the lid, especially with regards to single use plastic shopping bags. Education and outreach efforts need to be reinforced as often as possible and a visual reminder on the recycle container will help alleviate confusion.

F3: Orange County Waste and Recycling as well as the waste haulers provide helpful recycling education to the public where contractually required to do so. It is the Grand Jury’s view that most cities delegate much of the customers/public education efforts to the waste haulers. Contracts indicate both parties are responsible for educating the public.

Related Recommendations (1)

R2: Municipalities should ensure that recycle bins be labeled with comprehensive recycling instructions to facilitate proper sorting of waste (F2 and (F3).

F4: Cities are not in compliance with AB 341 mandates with respect to providing recycling containers for multi-family units.

Related Recommendations (1)

R3: Cities, that have not already do so, should implement the requirements of AB 341 as they pertain to multi-family recycling programs. Additionally, such programs need to be closely monitored by city contract administrators rather than relying solely on waste haulers to fulfill the mandates (F4).

March 12, 2020 — Grand Jury 2019-2020 The Transportation Corridor Agencies- Are They Taking Their Toll On Orange County?

58 pages 14 findings 11 recommendations

Quick View Full Details →

Findings & Recommendations 14 findings

F1: The SJHTCA has completely fulfilled its original mandate to plan, finance, and build SR- 73 yet it continues to involve itself in future planning efforts, some of which are probably outside the purview with its charter.

F2: Some budget cost allocations burden SJHTCA with costs not associated with an agency who has fulfilled its mandate, such as Strategic Planning and Advocacy. Based on relative road lengths, SJHTCA is allocated more than its share of common TCA costs, reducing its ability to retire its debt.

F3: The F/ETCA has fulfilled the bulk of its original mandate to plan, finance, and build the SR-133, 241, 261 transportation corridor network. Only the SR-91 to SR-241 connector and in compliance with the approved Alternative 22 to the SCTRE report, the termination of the link between SR-241 and I-5 remain to be completed.

F4: The TCA has been and continues to be involved in projects, such as the I-5 HOV and HOT lanes, toll road enhancements, bike lanes, landscape maintenance, which may be considered beyond its original and currently legislated mandate.

F5: With the exception of the repayment of its accumulated debts, there appears to be little if anything in the matter of highway planning, construction, or any county transportation activities the TCA can do that is not already being accomplished by OCTA and/or Caltrans.

F6: The TCA receives payment of Development Impact Fees for new construction per the Major Thoroughfare and Bridge Fee Program which remains in effect until all TCA bonds have been fully repaid, requiring Orange County residents and corporations to continue to pay the fees which increase every year.

F7: While the idea of using tolls to fund the development of new state highways in California’s historically free highway system enabled construction of the roads, toll lanes 2019-2020 Orange County Grand Jury The Transportation Corridor Agencies- Are They Taking Their Toll On Orange County? are now instead being used to increase the average speed of HOV lanes to meet the federal mandate.

F8: The TCA employs political and public relations consultants as a promotional tool to help broaden its scope of activities (to include advertising aimed at improving its public image) that would extend beyond its legislated boundary limits.

F9: The TCA has a capable in-house communications staff as evidenced by the excellent COVID-19 Communications Plan.

F10: Not all material presented in TCA committee meetings is available in the Board Meeting packet resulting in an incomplete presentation to the Board and public.

F11: Recently, much of the planning is being performed by consultants and TCA staff, who have a financial interest in seeing the TCA continue beyond its original mandate, and out of view of many of the TCA board members and the public thus creating a conflict of interest issue.

F12: Elected officials who have voiced opposition to the TCA have been subjected to negative information campaigns by TCA proponents.

F13: It appears that neither the F/ETCA nor the SJHTCA has complied with April 5, 2001 MOU signed by each of these agencies with SCAG regarding their agreement to collectively construct approximately 150 additional lane miles of highway to (per section 1.1, 1.2, 1.3 Recitals, and following) over the ensuing span of the agreement.

F14: It was observed that some elected BoD members showed limited knowledge of the agreements and codes that govern the creation and operation of their agency possibly contributing to the potential for poor management and/or leadership.

February 25, 2020 — Grand Jury 2019-2020 Electric Vehicles Are Here- Is Orange County All Charged Up?

15 pages 1 findings 3 recommendations

Quick View Full Details →

Findings & Recommendations 1 findings

F1: Eight Orange County cities, Fountain Valley, Garden Grove, Laguna Beach, Laguna Woods, Lake Forest, Placentia, Seal Beach, and Yorba Linda, have not fully complied with AB 1236 that requires cities to implement a streamlined process in obtaining permits to install EVCS and make it available to the public on their city websites, thus impeding residents’ ease of installation of EVCS.

Related Recommendations (3)

R1: Cities, that have not already done so, should update their municipal code to add an ordinance streamlining their EVCS permitting process by May 1, 2020. (F1) 19 Office of the State Treasurer (CA); California Pollution Control Financing Authority, https://cbig.ca.gov/Government-Partners/California-Pollution-Control-Financing-Authority. Ibid.

R2: Cities, that have not already done so, should create a streamlined permit process for single family residences, multi-family residences and businesses to obtain permits to install EVCS that includes an easy to use checklist by May 1, 2020. (F1)

R3: Cities, that have not already done so, should describe the streamlined EV charging installation permit application process and have the checklists and forms available on their website by May 1, 2020. (F1) COMMENDATION The 26 Orange County cities not mentioned in this report have complied with at least the basics of AB 1236, as has the County of Orange for unincorporated areas. The city of Irvine is a good example of a city that has fully complied. There is a page on that city’s website dedicated to EV charging containing links to permit applications, a related Southern California Edison website, and a map of EVCS. This example may be used by cities that have not complied with AB 1236 to aid them in updating their processes and website. The city of Irvine is commended for fully implementing the mandates. Their web page can be found by searching “EV charging” or “EVCS” from the Irvine city website home page or navigating to the uniform resource locator (URL) below. https://www.cityofirvine.org/community-development/electric-vehicle-service-equipment-evse RESPONSES The following excerpts from the California Penal Code provide the requirements for public agencies to respond to the Findings and Recommendations of this Grand Jury report: §933 (c) No later than 90 days after the grand jury submits a final report on the operations of any public agency subject to its reviewing authority, the governing body of the public agency shall comment to the presiding judge of the superior court on the findings and recommendations pertaining to matters under the control of the governing body, and every elected county officer or agency head for which the grand jury has responsibility pursuant to Section 914.1 shall comment within 60 days to the presiding judge of the superior court, with an information copy sent to the board of supervisors, on the findings and recommendations pertaining to matters under the control of that county officer or agency head and any agency or agencies which that officer or agency head supervises or controls. In any city and county, the mayor shall also comment on the findings and recommendations. All of these comments and reports shall forthwith be submitted to the presiding judge of the superior court who impaneled the grand jury. A copy of all responses to grand jury reports shall be placed on file with the clerk of the public agency and the office of the county clerk, or the mayor when applicable, and shall remain on file in those offices. One copy shall be placed on file with the applicable grand jury final report by, and in the control of the currently impaneled grand jury, where it shall be maintained for a minimum of five years. 933.05. (a) For purposes of subdivision (b) of Section 933, as to each grand jury finding, the responding person or entity shall indicate one of the following: (1) The respondent agrees with the finding. (2) The respondent disagrees wholly or partially with the finding, in which case the response shall specify the portion of the finding that is disputed and shall include an explanation of the reasons therefor. (b) For purposes of subdivision (b) of Section 933, as to each grand jury recommendation, the responding person or entity shall report one of the following actions: (1) The recommendation has been implemented, with a summary regarding the implemented action. (2) The recommendation has not yet been implemented, but will be implemented in the future, with a timeframe for implementation. (3) The recommendation requires further analysis, with an explanation and the scope and parameters of an analysis or study, and a timeframe for the matter to be prepared for discussion by the officer or head of the agency or department being investigated or reviewed, including the governing body of the public agency when applicable. This timeframe shall not exceed six months from the date of publication of the grand jury report. (4) The recommendation will not be implemented because it is not warranted or is not reasonable, with an explanation therefor. (c) However, if a finding or recommendation of the grand jury addresses budgetary or personnel matters of a county agency or department headed by an elected officer, both the agency or department head and the board of supervisors shall respond if requested by the grand jury, but the response of the board of supervisors shall address only those budgetary or personnel matters over which it has some decision-making authority. The response of the elected agency or department head shall address all aspects of the findings or recommendations affecting his or her agency or department. (d) A grand jury may request a subject person or entity to come before the grand jury for the purpose of reading and discussing the findings of the grand jury report that relates to that person or entity in order to verify the accuracy of the findings prior to their release. (e) During an investigation, the grand jury shall meet with the subject of that investigation regarding the investigation, unless the court, either on its own determination or upon request of the foreperson of the grand jury, determines that such a meeting would be detrimental. (f) A grand jury shall provide to the affected agency a copy of the portion of the grand jury report relating to that person or entity two working days prior to its public release and after the approval of the presiding judge. No officer, agency, department, or governing body of a public agency shall disclose any contents of the report prior to the public release of the final report. (Amended by Stats. 1997, Ch. 443, Sec. 5. Effective January 1, 1998.)

January 01, 2020 — Grand Jury 2019-2020 Protecting Those Who Protect and Serve

17 pages 6 findings 4 recommendations

Quick View Full Details →

Findings & Recommendations 6 findings

F1: Peer Support Programs are effective in helping Peace Officers develop healthy coping techniques for themselves and their families.

Related Recommendations (1)

R1: The 2019-2020 Orange County Grand Jury recommends that that the four law enforcement agencies without a written policy on their Peer Support Program institute a policy. (F1, F2)

F2: A written policy documenting each agency’s Peer Support Program helps ensure the program’s continuation after changes in staff.

Related Recommendations (1)

R1: The 2019-2020 Orange County Grand Jury recommends that that the four law enforcement agencies without a written policy on their Peer Support Program institute a policy. (F1, F2)

F3: The benefits in the peer support statute, effective January 1, 2020, are important to Peace Officers and Peer Support Team members.

Related Recommendations (1)

R2: The 2019-2020 Orange County Grand Jury recommends that all Peer Support Programs be in compliance with the peer support statute. (F3)

F4: It is important that Peer Support Team members receive periodic training.

Related Recommendations (1)

R3: The 2019-2020 Orange County Grand Jury recommends that Peer Support Team members receive periodic training and that completion of training is documented. (F4)

F5: Allocating a specific budget line item for Peer Support Programs help ensure adequate training and continuation of the programs.

Related Recommendations (1)

R4: The 2019-2020 Orange County Grand Jury recommends that all law enforcement agencies allocate a specific budget line item for their Peer Support Program. (F5)

F6: Continuous communication to Peace Officers about the Peer Support Programs is important to increase awareness and use of the Peer Support Programs.

Grand Jury 2019-2020 Orange County’s Cybersecurity Preparedness

19 pages 4 findings 3 recommendations

Quick View Full Details →

Findings & Recommendations 4 findings

F1: Some County departments are not submitting monthly vulnerability scan results of their computer devices to OCIT to be entered into the County’s enterprise Governance, Risk Management, and Compliance platform, and are non-compliant with the County Vulnerability Management Policy.

Related Recommendations (1)

R1: All County departments, including those with elected heads, should be required to comply with the County’s Vulnerability Management and Patch Management Policies, or request variances from them, per the County’s Variance Review and Approval Process Policy. (F1-F3)

F2: Some County departments have not established or submitted procedures to ensure application of software security patches based upon the severity level of the vulnerability, and are non-compliant with the County Patch Management Policy.

Related Recommendations (1)

F3: Even though a number of County departments are not in compliance with the County’s Vulnerability Management Policy or Patch Management Policy, there have been no requests or approvals for variances from these policies, per the requirements of the County’s Variance Review and Approval Process Policy.

Related Recommendations (1)

F4: The County’s most recent Vulnerability/Penetration Assessment, performed by independent consultants in June 2019, was deemed to be “Incomplete,” as only a portion of the County’s externally facing servers and internal networks were permitted to be evaluated. An incomplete vulnerability/penetration assessment increases the potential vulnerability of County information systems.

Related Recommendations (1)

R2: All external facing servers and internal networks from all County departments, including those with elected heads, should be required to be included in future County vulnerability/penetration assessments so that the cybersecurity assessments can be considered complete. (F4) RESPONSES The following excerpts from the California Penal Code provide the requirements for public agencies to respond to the findings and recommendations of this Grand Jury report: §933 “Comments and Reports on Grand Jury Recommendations.” “(c) No later than 90 days after the grand jury submits a final report on the operations of any public agency subject to its reviewing authority, the governing body of the public agency shall comment to the presiding judge of the superior court on the findings and recommendations pertaining to matters under the control of the governing body and every elected county officer or agency head for which the grand jury has responsibility pursuant to Section 914.1 shall comment within 60 days to the presiding judge of the superior court, with an information copy sent to the board of supervisors, on the findings and recommendations pertaining to matters under the control of that county officer or agency head or any agency or agencies which that officer or agency head supervises or controls. In any city and county, the mayor shall also comment on the

Additional Recommendations 1

Not linked to specific findings.

R18: OCIT should establish standardized procedures for conducting periodic cybersecurity vulnerability and penetration testing by 12/31/19. County Response from Sept 2017: This recommendation has been implemented. This process is implemented and is currently being realized through the countywide cyber security audits and assessments. Additionally, OCIT oversees the conduct of a penetration test of the County externally facing network systems and security appliances. Part of this annual penetration testing is also to conduct a comprehensive vulnerability scan and social engineering penetration test. Social Engineering is the act of manipulating an employee into providing access to county information systems and networks through either a phishing attempt, phone scams and or other means of contacting the target of the attack. Penetration testing services are also offered under the Tevora RCA for audit and assessment services. It is noted that the Cybersecurity Joint Task Force (CSJTF) is a committee formed to oversee County cybersecurity policy development, and to insure that county assets and systems are as safe as practicable now and into the future. The Cybersecurity Joint Task Force (CSJTF) is comprised of representatives from County Risk Management, Departmental Administrative Services, and Departmental Information Technology, and is chaired by the County Chief Information Security Officer (CISO). The purpose of the CSJTF task force is to develop and oversee compliance with the County Cybersecurity Manual, which establishes a common set of standards and practices to improve the Cybersecurity posture for all County departments. In 2018, OCIT procured a software platform for its Governance, Risk Management & Compliance (GRC) initiative. The GRC provides a central location for assessment results from throughout the county. This information along with controls, drives actions that will mitigate cyber threats. The GRC platform is used to track individual findings and vulnerabilities that can be followed down to a specific location. This results in a disciplined and efficient approach to remediation of cybersecurity deficiencies, whether they are technical in nature or administrative.1 The potential threats in the cybersecurity landscape are ever-evolving, and it is imperative that the County ensure compliance with its adopted policies across all County departments, and continue to evaluate and implement new measures to their cybersecurity protocols and procedures. State of County Cybersecurity Reports A review was made of the two most recent State of County Cybersecurity reports prepared by Orange County Information Technology (OCIT), dated June 2018 and December 2019. These reports were requested from OCIT by the Board of Supervisors to provide an update on the state of the County’s cybersecurity preparedness. The December 2019 report indicates that OCIT is responsible for approximately seventy-five percent of the County’s cyber preparedness program. While OCIT collaborates and assists in various ways with the remaining twenty-five percent of the County, they state that they realistically cannot certify that the County fully complies with the cyber preparedness program across all County departments. OCIT recommends in its report that the Board of Supervisors initiate steps to consolidate all technology infrastructure across all County departments. The 2019 State of County Privacy and Cybersecurity report also identifies some of OCIT’s recent cybersecurity efforts. OCIT has deployed an enterprise solution for vulnerability scanning which is available to all County departments. The objective of the vulnerability management program is to reduce the time that a vulnerability is exposed to threats. The 2019 report also indicates that updating and patching of software is fundamental to effective cybersecurity hygiene and is critical for mitigation of risks related to ransomware exploitation. Rapid remediation of identified vulnerabilities with minimal user intervention is critical for large enterprises such as the County. OCIT recommends that the County acquire automated patching software tools to enhance its cybersecurity program. Continued follow-up and process improvement is critical to ensuring that the standards established in the County’s Vulnerability and Patch Management Policies are adhered to across all County departments. State of County Cybersecurity Bi-Annual Report, June 2018 County’s Cybersecurity Best Practices Manual The County’s Cybersecurity Best Practices Manual was prepared by the Cyber Security Joint Task Force and approved by the IT Executive Council at its August 2018 meeting. This manual provides a framework and describes best practices to establish a secure environment that safeguards the confidentiality, integrity and availability of the data and information systems used to manage the services provided by the County. The Cybersecurity Best Practices Manual applies to all departments in the County. To maintain a strong cybersecurity posture it is essential for cybersecurity programs to include procedures and controls implemented within all departments to secure data and information systems. Each department is required to develop a departmental cybersecurity program, with the procedures and controls included in the departmental program to be determined by the department. The Cybersecurity Best Practices Manual is intended to provide guidelines for departments, and any changes or modifications to the guidelines need to be discussed with OCIT. County Cybersecurity Policy The County has recently developed an overall County Cybersecurity Policy in order to provide guidance and protection to County employees, and to safeguard the information resources entrusted to employees. The County’s Cybersecurity Policy is based upon NIST SP 800-53 standards and best practices, and is considered the minimum standard for providing a secure environment. The County Cybersecurity Policy was approved and adopted by the CSJTF in August 2019. Although OCIT believes that passage of the Policy is the correct step, the CSJTF vote was not unanimous. The Policy recently passed a vote of the IT Executive Council, and as of the publication of this report is in the process of being approved and adopted by the County CEO. Following is a summary of some of the pertinent components of the County Cybersecurity Policy: • Approval/Revision Dates: Approved by CSJTF on August 8, 2019, pending approval by IT Executive Council and CEO • Authority: County Executive Office • Policy Owner: County Chief Information Officer • Policy: Departments shall develop, implement, and maintain a Cybersecurity program that consists of policies, procedures, plans, and guidelines for safeguards to protect information during storage, use or in transit. • Scope: This policy applies to all departments in the County as well as all employees, contractors, vendors, customers, and others who utilize, possess or have access to County IT resources. • Compliance: The County shall verify compliance with this policy. • Variances: Variances to this policy shall be documented and approved following the County Variance Review and Approval Process. • Non-Compliance: Non-compliance with this policy may result in significant delays to the implementation of information systems and/or technologies. Devices not in compliance with the Policy may have their access to the County’s network restricted. • Policy Control and Maintenance: The County Chief Information Security Officer is responsible for maintaining this policy. County Vulnerability Management Policy A vulnerability management process identifies, analyzes and manages vulnerabilities in an organization’s operating environment. The vulnerability management process is divided into three areas: Vulnerability Management – lays the foundation for the Vulnerability Management Program and establishes the management framework for monitoring, mitigating and preventing future vulnerabilities to County assets. Vulnerability Monitoring – commonly employs tools and process capable of detecting and determining various types of vulnerabilities and determining remediation and mitigation strategies. Vulnerability Remediation and Mitigation – involves the analysis of risk from identified vulnerabilities, prioritizing those vulnerabilities and determining remediation and mitigation strategies. As part of its vulnerability management program, the County adopted a Vulnerability Management Policy in August 2018. Following is a summary of its pertinent components: • Approval/Revision Dates: Approved 8/15/2018, No Revisions • Authority: County Executive Office • Policy Owner: County Chief Information Officer • Policy: Each Department shall develop and maintain a Vulnerability Management process as part of its Cybersecurity program, and shall perform monthly vulnerability scans with the results entered into the County enterprise GRC platform. • Scope: This policy applies to all County departments. • Compliance: An entity designated by the County shall verify compliance to this policy through various methods including internal and external audits. • Variances: Variances to this policy shall be documented and approved following the County Variance Review and Approval Process. • Non-Compliance: Non-compliance with this policy may result in unidentified vulnerabilities that compromise County data and/or assets • Policy Control and Maintenance: The County Chief Information Security Officer is responsible for maintaining this policy. OCIT has deployed an enterprise solution for vulnerability scanning which is available to all County departments. OCIT advised the Grand Jury that while most County departments are currently participating and utilizing this vulnerability scanning software, some departments may be utilizing other software and have not provided scanning results to OCIT on a monthly basis to be in compliance with the Vulnerability Management Policy. OCIT advised the Grand Jury that the departments which are currently not submitting vulnerability scan results include the Auditor/Controller, Treasurer/Tax Collector, Health Care Agency, Sheriff/Coroner, District Attorney, and Public Defender. While the Grand Jury has been informed by County executives that they do not have the authority to instruct elected officials on how to operate their departments, the Grand Jury believes the County has the oversight responsibility and liability for the County Policies pertaining to the County owned computer systems and data residing within all County departments, including those headed by elected officials. The Grand Jury believes that the County needs to do more than recommend compliance to departments with elected officials, and should require all County departments to comply with its cybersecurity policies, including this Vulnerability Management Policy. In-lieu of participating in the County’s monthly vulnerability scanning, a department could choose to comply by performing their own vulnerability scans and providing the results to the County Governance, Risk and Compliance platform. County Patch Management Policy Patch management has emerged as one of the more critical issues for today’s IT organizations. The importance of efficient application of vendor-supplied patches cannot be understated, particularly in light of increasing vulnerability alerts, intrusion activity, and virus proliferation. Vulnerabilities arising from unpatched or misconfigured software account for the majority of all internet security breaches. Patch management is integral to a department’s cybersecurity program, in particular its vulnerability management program. Responsible IT organizations have an obligation to establish assertive, systematic patch management processes based upon a solid foundation of policy, procedures and training. Failure in doing so is to court risk and invite disruption of business activity. As part of its cybersecurity program, the County adopted a Patch Management Policy in August 2018. Following is a summary of its pertinent components: • Approval/Revision Dates: Approved 1/28/2004, Revised 8/15/2018 • Authority: County Executive Office • Policy Owner: County Chief Information Officer • Policy: County departments shall establish internal processes and procedures to ensure efficient application of vendor-supplied security patches based upon the severity level of the vulnerabilities identified. • Scope: This policy applies to all County departments. • Compliance: An entity designated by the County shall verify compliance to this policy through various methods including internal and external audits. • Variances: Variances to this policy shall be documented and approved following the County Variance Review and Approval Process. • Non-Compliance: Non-compliance with this policy may result in vulnerabilities that compromise County data and/or assets. Devices not in compliance with this policy may have their access to the County’s network restricted. • Policy Control and Maintenance: The County Chief Information Security Officer is responsible for maintaining this policy. OCIT advised the Grand Jury that while most County departments are currently participating and have established internal processes and procedures to ensure efficient application of vendor supplied security patches, some departments have not, and are not in compliance with the Patch Management Policy. The Grand Jury requested the status of compliance for each department with the Patch Management Policy from OCIT, however this information was not received prior to the publication of this report. Reiterated from the discussion on the prior policy, the Grand Jury believes that the County has the oversight responsibility and liability for County Policies pertaining to the County owned computer systems and data residing within all County departments, including those headed by elected officials. The Grand Jury believes that the County needs to do more than recommend compliance to departments with elected officials, and should require all County departments to comply with its policies related to cybersecurity, including this Patch Management policy establishing internal processes and procedures to ensure efficient application of vendor-supplied security patches. County Cyber Incident Reporting Policy As part of its cybersecurity program, the County adopted a Cyber Incident Reporting Policy in September 2018. The County Cyber Incident Reporting Policy seeks to ensure that the Board of Supervisors, County Executive Office, and impacted Department Heads are informed of significant cybersecurity incidents in a timely manner. Following is a summary of the pertinent components of the Cyber Incident Reporting Policy: • Approval/Revision Dates: Approved 9/26/2018, No Revisions • Authority: County Executive Office • Policy Owner: County Chief Information Officer • Policy: County departments shall report cybersecurity incidents to the Central IT Service Desk. Confirmed cybersecurity incidents that meet the criteria defined in the Significant Incident/Claim Reporting Protocol shall be reported by the CISO to the CIO, CEO, and the Board of Supervisors within 24 hours. County departments shall review and confirm the accuracy of the Confirmed Cybersecurity Incident Report prepared by OCIT annually. • Scope: This policy applies to all County departments. • Compliance: The County shall verify compliance to this policy including internal and external audits. • Variances: Variances to this policy shall be documented and approved following the County Variance Review and Approval Process. • Non-Compliance: Non-compliance with this policy may result in cybersecurity incidents not being properly reported and addressed. • Policy Control and Maintenance: The County Chief Information Security Officer is responsible for maintaining this policy. • Reporting Criteria: The CISO shall report to the Board of Supervisors any confirmed cybersecurity incident that meets any of the following criteria: Involves a natural disaster or other incident that impact County residents and o property Involves an unusual or significant dangerous condition of property that is owned, o occupied or maintained by the County Involves sensitive issues of government practices or public policy o Involves multiple cities or jurisdictions and will require coordination with cities, o state agencies/departments, and or the federal government Involves reports from County contracted consultants or a government agency o critical of County policy, procedure or processes Has the potential to result in a claim/litigation against the County o May attract significant media attention o It is imperative to County decision-makers and residents that significant cyber incidents which occur on County IT systems and networks be reported to the County CIO, CEO, and Board of Supervisors within 24 hours. OCIT indicated that as of January 2020, there have been no confirmed cybersecurity incidents reported to them which meet the criteria defined in the Significant Incident/Claim Reporting. The Grand Jury requested documentation from OCIT confirming compliance with this County Policy, however this information was not received prior to the completion of its investigation. County Variance Review and Approval Process Policy The County Policy for Variance Review and Approval Process allows for Department heads and County leadership to make an informed decision on whether or not to accept a variance from the Cybersecurity Best Practices Manual or County policies by understanding the risks and alternatives involved. All requests for variances are to be documented using the County Variance Request Form and are to be logged in a central repository, to be maintained by OCIT. Approved County Variance Request Forms shall be reviewed at least annually for renewal by the CISO and the department requesting the variance. Following is a summary of the pertinent components of the Variance Review and Approval Process Policy: • Approval/Revision Dates: Approved 4/2/2018, No Revisions • Authority: County Executive Office • Policy Owner: County Chief Information Officer • Policy: The procedure will allow department heads and County leadership to make an informed decision on whether or not to accept a variance from the Cybersecurity Manual or County Policy by understanding the risks and alternatives involved. • Scope: This procedure applies to all departments in the County. • Compliance: An entity designated by the County shall verify compliance to this policy through various methods including internal and external audits. • Variances: Variances to this policy shall be documented and approved following the County Variance Review and Approval Process. • Non-Compliance: Non-compliance with this policy may result in significant delays to the implementation of information systems and/or technologies. • Policy Control and Maintenance: The County Chief Information Security Officer is responsible for maintaining this policy. A review of the current repository of all requested variances indicates that only four requests for variances have been received as of February 2020. A summary of the four variance requests is set out below: 1. August 2018 – Use of Administrative Accounts by system administrators 2. August 2019 – ROV Windows 2000 Plate Printers 3. February 2019 – OCCR Public Library Network Traffic Monitoring 4. February 2019 - Clerk of the Board Desktop Admin Account While the total number of existing issues requiring variances from the County’s cybersecurity best practices and policies is unknown, it is apparent that many non-compliant issues currently exist. It is imperative that all County departments comply with the County’s adopted cybersecurity best practices and policies or submit the required requests for variances. Security Architecture and Vulnerability/Penetration Assessment As part of the Grand Jury’s investigation into the County’s cybersecurity preparedness, a review was made of the most recent Security Architecture and Vulnerability/Penetration Assessment, dated July 12, 2019, which was conducted by IT consultants retained by the County. The Security Architecture Assessment compared the capabilities of the security tools deployed by the County, as well as the security process used by the County, with an appropriate set of security controls derived from the NIST 800-53 Standard. The results of this assessment provide the OCIT Security organization with a prioritized list of initiatives to implement new or different security tools or security processes. These initiatives can better equip the County of Orange to proactively combat the growing cybersecurity attacks causing data breaches and millions of dollars of potential ransomware. The External and Internal Security Assessments assessed the vulnerability of selected external and internal computing and network devices of the County. The IT consultant deployed several automated tools and utilized techniques in order to evaluate the vulnerability of servers, workstations and networking devices to a cybersecurity attack across the public internet, or origination from within the County’s internal networks. Based on the results of the Security Architecture Assessment, the County’s existing security controls can provide the majority of the security controls that the County should have in place, but there are several significant gaps in controls that need to be addressed. The two most significant findings of this assessment were that many of the County’s external and internal hosts are running out-of-date software, and that numerous departments/agencies chose not to participate and therefore the assessment was deemed by the consultants to be “Incomplete.” The assessment also concluded that because of the prevalence of out-of-support and unpatched software in the County’s environment, the County is at “high risk” of being compromised by a cyberattack. While the Grand Jury has been informed by County executives that they do not have the authority to direct elected officials on how to operate their departments, the Grand Jury believes the County has the responsibility and liability for the County owned computer systems and data residing within all County departments, including those headed by elected officials. It is recognized that penetration testing assessments can be disruptive and interfere with regular business operations. However, the County’s IT consultant who performed the most recent assessment has indicated that a penetration assessment could be conducted during off-business times and terms acceptable to individual department’s IT needs and security requirements. The Grand Jury believes that the County needs to do more than recommend participation in future County-wide vulnerability/penetration assessments, and should require all external facing servers and internal networks from all County departments to be included. In-lieu of participating in the County conducted vulnerability/penetration assessment, a department could choose to comply by performing its own vulnerability/penetration assessments and provide the results to the County, as long as the criteria for the assessment is equal to or exceeds County standards.

Grand Jury 2019-2020 What’s Happening with the Historic Tustin Hangars?

30 pages 5 findings 2 recommendations

Quick View Full Details →

Findings & Recommendations 5 findings

F1: The County of Orange has explored numerous planning options and development proposals regarding Parcel 18 within former MCAS Tustin over the past twenty-five years, yet has been ineffective in its efforts and has not been able to produce an approved economically viable plan within the constraints of its Park Public Benefit Conveyance.

Related Recommendations (1)

R1: Given the altered conditions since the initial planning, the County of Orange should reevaluate its ability to provide additional value or benefit to county residents from its involvement with the redevelopment of Parcel 18 as a county regional park, and the Board of Supervisors should determine within 90-days of the release of this report whether to proceed with or withdraw from its PBC application. (F1 thru F5.)

F2: Although the County of Orange has indicated an interest in applying to the National Park Service to alter their conveyance mechanism to a Historic Monument PBC, it has made limited progress and currently has no economically viable proposals within the constraints of a Historic Monument PBC.

Related Recommendations (1)

F3: The City of Tustin commenced licensing the historic South Hangar for interim uses in 2013 and has recently moved forward with its plans to renovate and retain the South Hangar. The planned retention of the South Hangar significantly limits the potential economic viability and public benefits of also retaining the North Hangar.

Related Recommendations (2)

R2: As the Local Reuse Authority, the City of Tustin should commence initial steps and planning with the Department of the Navy for incorporating Parcel 18 into its Economic Development Conveyance to meet the objectives of the Tustin Legacy Specific Plan. (F3 and F4.) RESPONSES The following excerpts from the California Penal Code provide the requirements for public agencies to respond to the findings and recommendations of this Grand Jury report: §933 “Comments and Reports on Grand Jury Recommendations.” “(c) No later than 90 days after the grand jury submits a final report on the operations of any public agency subject to its reviewing authority, the governing body of the public agency shall comment to the presiding judge of the superior court on the findings and recommendations pertaining to matters under the control of the governing body and every elected county officer or agency head for which the grand jury has responsibility pursuant to Section 914.1 shall comment within 60 days to the presiding judge of the superior court, with an information copy sent to the board of supervisors, on the findings and recommendations pertaining to matters under the control of that county officer or agency head or any agency or agencies which that officer or agency head supervises or controls. In any city and county, the mayor shall also comment on the

F4: The City of Tustin appears to be in a more advantageous position than the County to redevelop the 85 acres within Parcel 18 as it is the Local Reuse Authority, and could potentially accept the property through its existing Economic Development Conveyance and re-plan/redevelop the property in joinder with adjacent property under its ownership.

Related Recommendations (2)

F5: The Navy has stated to the County of Orange that absent a viable plan and path forward on the transfer of Parcel 18 to the County, the Navy will re-engage the National Park Service and the City of Tustin to discuss an alternative conveyance mechanism to meet the objectives of the original agreement and the Tustin Legacy Reuse Plan.

Related Recommendations (1)

* This report's PDF did not contain easily extractable text and required Optical Character Recognition (OCR) for analysis. There may be minor errors in the extracted findings and recommendations due to OCR limitations with scanned documents.