Financial Stewardship
Accountability
Transparency
Port of Seattle Audit Committee
Internal Audit Update
Glenn Fernandes - Director, Internal Audit
September 19, 2024
P69 Commission Chambers
10:00 AM - 12:00 PM
Operational Excellence
Governance
Department Overview
Item #4
 Internal Audit, through an annual audit plan, provides assurance that the Port's
controls are effective and efficient. The department facilitates four public Audit
Committee meetings per year and non-public Audit Committee meetings as
needed.
 The department facilitates RCW required Independent Audits on General
Contractor/Construction Manager (GC/CM) Projects and periodically performs
or reviews the results of the required third-party Payment Card Industry
Audits.
 The department provides advisory services to the Port, to the extent that it
does not compromise the department's independence.
 The department maintains its independence and objectivity by reporting
functionally to the Audit Committee and administratively to the
Executive Director.
2
2025 Major Departmental Initiatives
Item #4
 Develop an Information Technology Audit Plan that focuses on Incident Response,
Disaster Recovery, Configuration & Security Management, Compliance with the
newly adopted IT Security Architecture, and Operational Technologies.
 Implement the Internal Audit Outreach Program:
• Increase awareness and understanding of the Internal Audit process and the
importance of internal controls and risk mitigation through targeted external
outreach and education efforts.
• Offer educational support to small business entities that partner with the Port,
especially those that do not have sufficient resources to train and educate their
staff on internal controls and risk management.
3
Internal Audit Organization Structure
Glenn Fernandes
Director
Saylor Nygaard
Sr. Administrative
Assistant
Manager
Internal Audit
Spencer Bright
Manager
Internal Audit - Capital
Ritika Marwaha
Nicole Uy
Kerem Onat
Brent Layman
Sr. Internal Auditor
Sr. Internal Auditor
Sr. IT Auditor
Derek Dewar
Nikita Goyal
Concession Auditor
Sr. Internal Auditor
Dan Chase
Item #4
Manager
Internal Audit - IT
Vacant
Sr. Internal Auditor
4
(Capitalized) Outside Services
Item #5
GC/CM Audit Costs (Outside Services) are directly capitalized to each Project and are not reflected in the expense budget. Below
is a summary of GC/CM spending for informational purposes.
Project
Post IAF Airline Realignment
C Concourse Expansion Project
Main Terminal Low Voltage Project
South Concourse Evolution
Primary Fire Station (Eastside)
Industrial Wastewater Treatment PlantHeavy Civil GC/CM1
Baggage Optimization 3
Concourse HVAC Improvement
Renewal/Replacement Program (CHIRRP)
Terminal 25 South Restoration
(Heavy Civil GC/CM)
Main Terminal Improvement Program1
Terminal 46 North Berth Reconstruction
(Heavy Civil GC/CM)
Concourse Low Voltage Upgrades
Total
2024 Costto-Date
Total Cost-toDate
Est. Audit Spend
over Life of Project
Project Life
52,468
16,280
-
79,124
37,581
-
$ 222,445
304,000
73,555
635,000
21,805
118,500
In Process, expected completion 2027
In Process, expected completion 2026
In Process, expected completion 2026
In Process, expected completion 2032
In Process, expected completion 2026
In Process, expected completion 2029
-
-
270,000
180,000
In Process, expected completion 2027
Expected timeline 2025 - 2031
-
-
-
-
-
Expected timeline 2025 - 2028
Construction and audit budgets not established
499,200
In Process, expected completion 2034
47,000
Timeline not established
-
-
27,195
$ 68,748
$ 116,705
$ 2.39MM
In Process, expected completion 2026
1. Audit services starting in 2026.
5
Item #5
New Budget Requests
Item #
Short Description
1
Increase in Employee Travel /
Trainings - IT Training / a large part
is the cost to obtain PCI ISA
certification for 2026
Total
Full Year 2025
O&M Amount Cash including Request Type No. of FTEs Priority (H/M/L)
Capital
$ 8,525
$ 8,525
$ 8,525
$ 8,525
Limited Term 2
0
Medium
0
6
2025 Budget Overview
Internal Audit 2280
Line
Account Description
1 Salaries and Benefits
$
2 Equipment Expense
3 Supplies & Stock
4 Outside Services
5 Travel & Other Employee Expense
6 Promotional Expenses
7 General Expenses
8 Other Expenses
9 Total Charges To Capital
Non Payroll Subtotal
$
Total
$
2023
Actual
1,763,560 $
6,846
1,466
73,675
40,230
0
237,932
7,727
0
367,876 $
2,131,436 $
2024
2025
Budget
Budget
2,118,896 $ 2,193,568
563
563
1,000
1,000
42,095
2,095
52,287
60,812
0
0
505
505
8,397
8,004
0
0
104,847 $
72,979
2,223,743 $ 2,266,547
Item #5
2025 Bud to 2024 2025 Bud to 2024
Bud Change $
Bud Var %
$
74,672
3.5%
0
0
(40,000)
(95.0%)
8,525
16.3%
0
0
(393)
(4.7%)
0
$
(31,868)
-30.39%
$
42,804
1.92%
7
Item #6
2024 AUDIT PLAN STATUS
Audit Title
Fire Department - PFAS Use, Storage, and Phase-out
Performance
Time Approval Controls
Performance
Delegation of Authority
Performance
Equity Policy Directive Compliance
Performance
Utility Management - Port-wide
Performance
Partner in Employment
3
Type
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
Performance
Concourse A Building Expansion for Lounges/DELTA TRA
1
Performance - Capital
T-117 Sites 23-25 Restoration Project GC/CM Closeout
Performance - Capital
TSE - Phase 2 Bollards and ADA Ramps
Performance - Capital
Parking Garage Elevator Modernization
Performance - Capital
Application Software Security
Jan
4
IT
Network Infrastructure Management (ICT)
IT
TSA Cybersecurity
IT
Stellar Bambuza SEA, LLC
Contract Compliance
Seattle Food Partners, LLC
Contract Compliance
1915 KCHouse Concepts - SEATAC, LLC
Contract Compliance
Pallino SeaTac, LLC
Contract Compliance
Seattle Chocolate Company, LLC
2
Contract Compliance
Complete
1. This audit was started in the Fourth Quarter of 2023 and completed in the First Quarter of 2024.
2. Added from the 2024 Contingency Audit Plan.
3. This audit was added to the 2024 Plan to assess the impact of fraud allegations.
4. Due to the recent Cybersecurity incident, the Audit Report is expected to be issued in November.
KEY
In Process
Not Started
Defer to 2025
8
Internal Audit Capital GC/CM Continuous Audits
Item #6
 RCW 39.10.385 requires an independent audit, paid for by the public body, to confirm the proper accrual of
costs.
 We procure the independent auditor, provide oversight of work performed, and assist in fieldwork as
needed.
 The independent auditor will provide the Audit Committee with annual updates and final reports upon
completion of each project.
Capital GC/CM Continuous Audits
Main Terminal Low Voltage System Upgrade
Under Contract
Post IAF Airline Realignment
Under Contract
C Concourse Expansion Project
Under Contract
Eastside Fire Station
Under Contract
Baggage Optimization Phase 3
Under Contract
Concourse Low Voltage Upgrade
Under Contract
South Concourse Evolution
Under Contract
9
Approved 2024 Audit Plan
Item #6
Limited Contract Compliance
Performance
Information Technology
• Stellar Bambuza SEA, LLC
• Seattle Food Partners, LLC
• 1915 KCHouse Concepts - SEATAC,
LLC
• Pallino SeaTac, LLC
• Seattle Chocolate Company, LLC2
Performance
• Fire Department - PFAS Use, Storage, and
Phase-out
• Time Approval Controls
• Delegation of Authority
• Equity Policy Directive Compliance
• Utility Management - Port-wide
• Partner in Employment3
• Application Software Security
• Network Infrastructure Management
(ICT)4
• TSA Cybersecurity5
Capital
• Concourse A Building Expansion for
Lounges/Delta TRA1
• T-117 Sites 23-25 Restoration Project
GC/CM Closeout
• TSE- Phase 2 Bollards and ADA Ramps
• Parking Garage Elevator Modernization
1. This audit was started in the Fourth Quarter of 2023 and completed in the First Quarter of 2024.
2. Added from the 2024 Contingency Audit Plan.
3. This audit was added to the 2024 Plan to assess the impact of fraud allegations.
4. Defer to the 2025 Audit Plan.
5. Any work related to the TSA assessment to be deferred to 2025.
10
Audits Completed in Third Quarter - 2024
Items # 7-9
1) Aqueous Film Forming Foam (AFFF) Transition (Item #7)
2) TSE Phase 2 Bollards and ADA Ramps Project (Item #8)
3) Seattle Food Partners, LLC 1 (Item #9)
1 Limited Contract Compliance Audits without any issues will not be presented, however, the final reports are made available.
11
Aqueous Film Forming Foam (AFFF) Transition
Item #7
 Audit Scope through August 15, 2024.
 Includes the Fire Department and airport facilities that use AFFF.
 Evaluated:
Measures to mitigate risks related to exposure to AFFF.
Transition to Per- and Polyfluoroalkyl Substances (PFAS)-free
alternatives.
 Reviewed:
Handling and storage of AFFF at tenant locations.
Plans for transitioning to PFAS-free alternatives.
12
Aqueous Film Forming Foam (AFFF) Transition
Item #7
POSFD transitioned to PFAS-Free Firefighting Foam (F3), with
decontamination of Aircraft Rescue and Fire Fighting (ARFF)
vehicles in August 2024.
Consolidated Rental Car Facility (CRCF): Early stages of
transitioning to water sprinkler systems.
Delta Airlines: Exploring water sprinkler systems for their
hangar.
Alaska hangar, PACCAR hangar, Seattle Airport Fuel Farm - No
definitive transition plans provided.
13
Aqueous Film Forming Foam (AFFF) Transition
Item #7
Washington State Senate Bill 6413:
 July 1, 2018 - Prohibits the discharge or use of Class B Firefighting Foam
containing intentionally added PFAS chemicals for training purposes.
 Imposes limitations on the production, sale, and distribution of Class B
Firefighting Foam containing PFAS chemicals; exemptions are granted to
airport facilities. September 2025 - eliminates all exemptions for the
purchase of AFFF.
Federal Aviation Administration (FAA):
 The FAA has approved the use of F3 that meets the new Military
Specification (MIL-SPEC) set by the Department of Defense (DoD).
14
Item #7
1) Rating: Medium
A lack of AFFF Disposal Planning by the POSFD and Aviation
Environment (AV-Env) posed Potential Storage Challenges after
transition to PFAS-free foam.
 POSFD lacked a comprehensive disposal plan.
 AFFF stored in Intermediate Bulk Container (IBC) totes outside the
POSFD building while awaiting a proper disposal strategy.
 Discussions include potentially using a hazardous waste facility for AFFF
disposal.
 The Port also needs to manage the disposal of approximately 1,000
gallons of AFFF at the Consolidated Rental Car Facility (CRCF).
15
Recommendations
Item #7
The POSFD, working with AV-Env, should promptly finalize a
storage and disposal plan for AFFF.
Assure all storage containers are clearly labeled and
regularly inspected for leaks and damages.
The Aviation Project Management Group (AVPMG) and
Aviation Commercial Management should work closely with
AV-Env to develop a disposal plan for AFFF for the Rental
Car Facility project.
16
2) Rating: Medium
Item #7
ARFF vehicle valves were actuated and were found to operate as intended with the new F3
foam. However, the POSFD had not yet decided, if and when, to test the valves on ARFF
vehicles on an ongoing basis. Failure to test the valves can pose a risk of valves
malfunctioning due to prolonged inactivity.
 ARFF vehicles utilize a valve-controlled system to mix AFFF and water for fire
suppression.
 To prohibit discharge of AFFF, POSFD implemented an Ecological Foam
machine in 2020.
 Mimics blending the AFFF concentrate with water without discharging it.
 Concerns raised about valve corrosion from prolonged inactivity.
 POSFD considering whether to adopt AFFF safety protocols for F3 foam.
17
Recommendations
Item #7
Going forward, the POSFD should establish Standard
Operating Procedures (in conjunction with the AV-Env) to
identify a process for valve functionality testing in ARFF
vehicles to mitigate the risk of malfunctioning due to
corrosion or prolonged inactivity.
18
Item #7
3) Rating: Medium
Internal Audit identified challenges in the maintenance of AFFF Fire Suppression
Systems at tenant locations. Additionally, the audit revealed potential operational
safety risks associated with delayed transitions to PFAS-free foam alternatives.
 PFAS Transition: Washington state exemption that prohibits the manufacture, sale, or
distribution of class B Firefighting Foam containing PFAS chemicals for airports facilities,
will expire on September 18, 2025.
 AFFF Supply Risks: Limited AFFF supplies due to the ban and accidental discharge could
affect fire suppression.
 Compliance Deadlines: The Port will no longer grant fire code waivers for non-compliance
after September 2025, potentially requiring tenants to upgrade systems to meet Authority
Having Jurisdiction (AHJ) standards.
19
Item #7
 Maintenance Issues: Leaks and spills at tenant facilities and recurring faults in aging fire
suppression systems despite regular maintenance; multiple accidental discharges reported.
 Environmental Impact: Continued use of PFAS foam poses environmental and reputational risks.
Leak History - Summary
Organization
Date
Swissport - SeaTac's Fuel Farm
2020
Delta Airline's Hangar
AFFF Discharge Amount
Unknown
Foam valve failure
1/12/2024
2,000 gallons
Sensor failure
4/27/2022
1,200 gallons
Short circuit in the fire panel
N/A - None reported as of 2021
Alaska Airline's Hangar
PACCAR's Hangar
Consolidated Rental Car Facility
(CRCF)
Nature
12/27/2021
2,000 gallons of water/foam mixture
Dry sprinkler head failure
1/17/2024
1,000 gallons of water/foam mixture
The AFFF system pipes ruptured due to freezing
and thawing at low points near the drum.
11/7/2023
Unknown
Leak within the AFFF system control room.
1/2/2022
1,800 gallons of water/foam mixture
The AFFF system pipes ruptured due to freezing
and thawing at low points near the drum.
20
Item #7
Consolidated Rental Car Facility
Leaks of unidentified fluid which could possibly be AFFF
Alaska Hangar
Leaks of unidentified fluid, as per AV-Env, it was likely Hydraulic Fluid
21
Recommendations
Item #7
Enhance the Port's existing inspection protocols by
incorporating AFFF storage areas into regular facility
assessments.
Establish a definitive deadline for tenants to submit their
transition plans to the Port.
Continue and potentially expand technical assistance to
tenants for PFAS-free alternative implementation.
22
4) Rating: Medium
Item #7
The 1995 E-One 5190 120 was inadvertently omitted during
the compilation of AFFF Inventory list.
 Vehicle contained 30 gallons of AFFF.
 This older vehicle requires a different AFFF removal approach than the
newer ARFF vehicles.
 A specific plan for managing the AFFF in this vehicle is still pending.
23
Recommendations
Item #7
The POSFD, in collaboration with AV-Env, should update the
AFFF inventory list to include this vehicle, and develop a
documented plan for managing its AFFF that aligns with
overall phase-out timelines and safety standards.
24
5) Rating: Medium
Item #7
There are inadequate policies, procedures, and training
documentation for AFFF handling at POSFD.
 Policy No. 316 is outdated and includes discontinued practices; no policies exist for
the new PFAS-free foam introduced in June 2024.
 AFFF is currently classified as hazardous by AV-Env, though not required by law, and
is covered under the Spill Prevention, Control, and Countermeasure (SPCC) plan,
which lacks specific mention of AFFF.
 AFFF training is held annually, but Vector Solutions, the tracking tool, is
infrequently updated, leading to incomplete training records. Some training
sessions are verbal and not documented.
25
Recommendations
Item #7
 Update Policy and Procedure No. 316 to reflect current practices and
remove references to discontinued practices, such as annual
discharge of AFFF for FAA compliance.
 Develop and implement policies for the new PFAS -free foam
introduced in June 2024.
 Update the SPCC plan to explicitly mention AFFF as one of the
hazardous substances managed under the plan.
 Improve documentation of safety trainings sessions for both AFFF
and PFAS-free foam.
26
Management Response - Issue 1
Item #7
 All AFFF at the POSFD is stored in labeled, secure containers with
secondary spill containment, following material handling laws, the
Stormwater Pollution Prevention Plan (SWPPP), and the SPCC plan.
 While there is no written comprehensive disposal plan due to evolving
requirements, the Port-Env and POSFD are evaluating options and will
finalize the removal process by the end of the year.
 The CRCF Fire Suppression System Capital Improvement project, which
began in August 2024, includes handling and disposing of AFFF, with
coordination among relevant departments.
DUE DATE: 10/31/2024
Management will discuss in detail. (Full response in Audit Report No. 2024-13)
27
Management Response - Issue 2
Item #7
 Foam valves in ARFF vehicles were tested and found operational, but testing
involves foam discharge, which risks firefighter exposures and environmental
impact. To minimize the risks, valve actuation and foam discharge are currently
restricted.
 The degree of PFAS rebounding into the new F3 foam from residual AFFF is
unknown. Rebound testing was planned and started in mid-August 2024 to
assess PFAS concentration.
 Based on rebound testing results, the POSFD will update policies and procedures
related to vehicle maintenance and foam discharge to address the new
conditions and ensure safety.
DUE DATE: 03/31/2025
Management will discuss in detail. (Full response in Audit Report No. 2024-13)
28
Management Response - Issue 3
Item #7
 The Port committed to supporting tenant transitions to non-PFAS systems,
but it cannot mandate these changes due to the absence of specific
regulations banning AFFF use; the current state only affects purchase and
distribution, not use.
 Port-Env. will request AFFF transition plans from tenants, including schedules
for planned transitions, by September 25, 2024.
 Port-Env and the Fire Department will continue to offer technical support to
tenants for transition planning, while avoiding actions that could expose the
Port to legal risks. Current efforts include frequent briefings and support but
will not extend to decision-making or enforcement.
DUE DATE: 09/25/2024
Management will discuss in detail. (Full response in Audit Report No. 2024-13)
29
Management Response - Issue 4
Item #7
 Port Fire Department and Port-Env appreciate identification of this inventory
oversight. The AFFF has already been removed from the onboard tank of the
E-One 120. Port Fire Department mechanics will disconnect the piping and
place a blank plate over the foam switches inside the rig. The vehicle can no
longer discharge AFFF. The vehicle has been equipped with a stand-alone
mobile tank of NovaCool, a PFAS-free firefighting foam, consistent with the
other two engine vehicles in the fleet that were drained of AFFF and
converted to NovaCool in 2020. Completion of the piping isolation and switch
plate cover will be completed before the end of the year.
DUE DATE: 12/31/2024
Management will discuss in detail. (Full response in Audit Report No. 2024-13)
30
Management Response - Issue 5
Item #7
 The Port's ARFF fleet transitioned to F3 on August 6, 2024. Policy No. 316 has
been updated to include practices for F3 foam and is under review until
September 4, 2024.
 Port-Env. will update the SPCC Plan and SWPP to align with handling AFFF as
if it were a hazardous substance, reflecting any necessary changes in the fiveyear updates and annual revisions.
 Firefighter training related to F3 foam and AFFF would be updated and
documented in Vector Solutions, ensuring all safety discussions and trainings
are accurately recorded and future sessions are included.
DUE DATE: 12/31/2024
Management will discuss in detail. (Full response in Audit Report No. 2024-13)
31
TSE Phase 2 Bollards and ADA Ramps
Item #8
 TSE Phase 2 Bollards and ADA Ramps project enhances accessibility and safety
in:
• Main terminal arrivals
• Departures curbsides
• The main garage at the pedestrian sky bridge entrances
• Courtesy vehicle plaza
 Project installed bollards and ADA access improvements.
 Arrivals curbside has a zero-curb environment.
 Design-Build method was used for this project between Hoffman and the Port.
32
Example of Bollards by a pedestrian Sky Bridge:
Item #8
33
Example of Bollards and ADA Ramp by Departures curbside:
Item #8
34
Item #8
TSE Phase 2 Bollards and ADA Ramps
 The total of the original contract was $13.8MM.
 As of July 2024, contract was at $13.9MM because of approximately $101K in
Change Orders.
 There is $111K in Open Trends, which projects the final contract to total $14MM
(1.5% increase).
Schedule (per July 2024, Trend Log)
Original Contractual Substantial Completion Date
Change Orders (+days)
Adjusted Contractual Completion Date
Trend 16 (+days)[1]
7/3/2023
80
9/21/2023
50
Adjusted Contractual Completion Date
11/10/2023
Actual Substantial Completion Date
11/13/2023
Contractual Phys. Completion
1/12/2024
Anticipated Project Completion
9/30/2024
 Project is anticipated to be completed by September 30, 2024.
35
Project Delay Timeline
80 days
50 days
Item #8
3 days
60 days
262 days
36
1) Rating: Medium
Item #8
The failure to verify all required insurance coverages before project
commencement risked non-compliance with contractual terms,
potentially leading to disputes, delays, or increased costs.
 Contractor was required to obtain Errors & Omissions insurance within 10 days of Notice
(Oct 15, 2021).
 CPO did not verify all insurance coverage.
 Insurance was met, but endorsements for stop gap, pollution, and liability were missing.
 Combined Pollution and Professional Liability policy risks exhausting coverage.
 Lack of insurance verification could lead to disputes, claims, delays, or higher costs.
37
Item #8
Recommendations
Existing SOP (3_Contract Award_3_4_3_Bonds and
Insurance) should be followed to ascertain that all
insurance documentation is obtained prior to project
commencement.
38
2) Rating: Low
Item #8
The Port did not create a change order for additional joint sealant work
prior to work starting.
 Joint sealant requirements were not defined during design.
 New sealant option initial proposal was up to $250K.
 The Port and the Contractor disagreed on cost.
 Not-to-exceed change order was not issued. The Port directed the work on Force
Account basis.
 Ultimately, new sealant work cost $111K and project was extended by 50 days.
 Overall, the Port did not comply with Construction Management Procedure 40.01.
• Risk: Potential financial overruns, contractual disputes, etc.
39
Item #8
Recommendations
Existing Standard Operating Procedures (SOP) should be
followed to ensure that no additional work commences
without an approved not-to-exceed change order in
place.
40
Item #8
Management Response - Issue 1
 CPO agrees with the recommendation and continues staff training for compliance.
 Annual training received from Risk Management on reviewing insurance
certificates and endorsements.
 CPO consults with Risk Management when endorsements are unclear or hard to
interpret.
 CPO uses an Insurance Matrix co-created with Risk Management to reduce
reliance on external review.
 CPO and Risk Management collaborate on self-insured policies, contractorcontrolled programs, or non-standard endorsements.
DUE DATE: N/A
Management will discuss in detail. (Full response in Audit Report No. 2024-12)
41
Management Response - Issue 2
Item #8
Engineering Construction Management agrees with the
recommendation and will continue to train staff to improve
compliance with these existing requirements.
DUE DATE: N/A
Management will discuss in detail. (Full response in Audit Report No. 2024-12)
42
Seattle Food Partners, LLC
Item #9
This is a Limited Contract Compliance Audit without any
issues and will not be presented during this meeting.
However, the final reports are made available.
43
Questions/Committee Comments
Items #11-12
44