The Denver City Council plans to carry out recommendations stipulated by a city audit, which alleged a lack of cybersecurity oversight within the governing body.

Denver City Council needs consistent security oversight, auditors say

Some recommendations had already been implemented when the audit was released on Dec. 21, according to a council spokesperson.

“Some recommendations have already been put in place and just need to be codified in written policy,” spokesperson Robert Austin told The Denver Gazette. “Many of the identified issues were already under our review and actively being addressed during the audit period.”

The audit was a nine-month process, and, over that time, the council was able to implement further audit recommendations, according to Austin.

The recommendations from Denver Auditor Timothy O’Brien urged stronger oversight on how the city processes technology with the council, including better tracking of how the legislative body uses technology, city-issued credit cards, as well as a better understanding of rules for councilmembers purchasing technology.

“We agree with the value of the audit observations and thank the audit team for its work,” Austin said. “Our dedication to operating with efficiency, transparency, and accountability remains unwavering for the benefit of the City and County of Denver and its residents.”

Auditors determined that the council had been inconsistent with security-related oversight practices, putting the city’s legislative body at risk for cyberattacks. The auditors also said some councilmembers failed to complete cybersecurity training.

“Cybersecurity is taken seriously at the council,” Austin said.

The council’s 2023 fourth quarter cybersecurity rate is 94%, an increase from 85% in the third quarter, a letter to the auditors showed.

The City Council, half of which is new, is five months into its term.

An inventory report showed 43 missing Dell, Microsoft, and Apple products, in addition to unreported technology purchases from councilmembers, auditors found.

Additionally, the City Council audit revealed 14 donations made from January 2021 to June 2023 to local organizations using city-issued credit cards. The council needs to request opinions from the city’s attorney’s office to measure the legality of making donations, while also documenting money being used, auditors recommended.

The council lacked a human resources manager during some of that time. But since September 2022, a new human resource manager had collected data to track inventory concerned in the audit, according to Austin.

“Had this audit been done in 2024, nearly all these issues would have been already addressed, such was our progress in the nine months during this audit,” Austin said.