From Finding to Follow-Up: A Six-Record Test for Municipal Risk

Municipal public records can reveal control weaknesses, corrective actions, claims experience, and unresolved work. They become misleading when those evidence layers collapse into one risk label.

An audit finding is not a loss estimate. Management agreement is not implementation. Contract authorization is not operating effectiveness. A filed claim is not a finding of liability. A payment made this year may resolve an event from many years earlier.

The six evidence layers

Begin with the operative requirement

California's Injury and Illness Prevention Program rule requires employers to establish, implement, and maintain an effective written program. Its elements include assigned responsibility, employee communication, hazard identification, incident investigation, timely correction, training, and employee access.

That provides a control baseline, not a conclusion about one municipality. The exception language matters too. Local governmental entities are exempt from keeping certain records concerning steps taken to implement and maintain the program. The exception concerns the recordkeeping provisions in subsection 3203(b). It is not an exemption from maintaining the program itself.

San Diego: management agreement began the chronology

San Diego's May 2022 workplace safety and workers' compensation audit examined whether the City effectively mitigated workplace hazards and whether controls addressed fraud, waste, and abuse in claims.

The safety review covered six departments. Claims and cost analyses principally used fiscal years 2017 through 2021, with some narrower periods. The report did not label every component deficient. It described a robust claims-administration process and concentrated its recommendations on prevention, safety management, incident analysis, and centralized monitoring of fraud indicators.

The audit reported $40.7 million in direct workers' compensation costs in fiscal 2021 and a $38.1 million annual average from fiscal 2017 through 2021. It separately estimated that indirect costs could bring the fiscal 2021 total as high as $224 million. The higher number used an indirect-cost estimate that included lost productivity. It is not booked claims, incurred loss, or a forecast.

The report also described a claims rate 17 percent higher than similar agencies, while noting that counts included accepted and denied claims and that costs were affected by legal requirements, COVID-19, and public-safety presumptions. The statistic raises a question. It does not answer causation or actuarial significance.

The auditor issued ten recommendations, and management agreed to all ten. A diligence review that stopped at agreement would miss the result.

Follow-up separates commitment from completion

The City Auditor's April 2026 follow-up report uses a December 31, 2025 status date. It deems a recommendation implemented only when management supplies sufficient and appropriate evidence for every element, or an accepted alternative addresses the risk.

Five recommendations had reached implemented status: performance indicators for the occupational safety program, analysis of employee survey information, annual notice of safety-reporting procedures, department-wide claims-trend reporting, and centralized monitoring of fraud indicators and tips.

Five remained in process and past due: department-specific prevention responsibility, leading and lagging indicators, safety-data collection and analysis, a citywide incident-investigation program, and standardized documentation of root causes and corrective actions. The report cited budget reductions, reorganization, and dependence on a new risk-management information system for several delays.

This is meaningful mixed evidence. Five recommendations had independently supported completion. Five remained past due. Neither side should be hidden by one control score.

A contract is an intermediate event

San Diego Ordinance O-22041, finally passed January 21, 2026, authorized a contract with Klear.ai for a new risk-management information system. It described a five-year base term costing $1,899,831.65, five optional one-year extensions, and a total not to exceed $3,935,428.24.

The intended system would support claims handling, regulatory compliance, incident tracking, reporting, and functions that had relied on manual processes. That is evidence of authority, funding structure, vendor selection, and intended scope. It is not evidence that the system was operating.

The follow-up report anticipated a March 2026 kickoff and phased implementation, with the safety module expected around January 2027. A diligence record should code the ordinance as an authorized corrective action and keep dependent recommendations open until later evidence verifies implementation and use.

New York City: payment year is not incident year

New York City's FY2023 Annual Claims Report says 13,227 claims and lawsuits were resolved for $1.45 billion during the fiscal year. The report itself explains why that total is not a current-incident measure.

A substantial portion of the fiscal 2022 and 2023 increase resulted from class and collective actions. The Gulino employment-discrimination case was filed in 1996, with judgment payments scheduled across fiscal years 2022 through 2028. Gulino and Fair Labor Standards Act class-action payments totaled $259.6 million in fiscal 2023. The City also paid $77.4 million in fiscal 2023 for personal-injury claims filed before fiscal 2014.

Payment timing reflected legacy litigation, negotiated schedules, and resolution pace. The $1.45 billion is a valid payment-year measure. It is not the value of incidents arising during fiscal 2023.

Medical-malpractice data make the distinction clear. The report says those cases often need five to ten years to resolve and identifies filings as a better current-activity measure than one year's payout. In fiscal 2023, 398 claims were filed, 64 resolved, and $51.5 million paid. In fiscal 2022, 441 were filed, 103 resolved, and $81.1 million paid. Filing, resolution, and payment describe different populations and dates.

Read the claims lifecycle before comparing counts

The Comptroller's Claims Dashboard overview describes a sequence from Notice of Claim through investigation, possible pre-litigation settlement, and possible lawsuit. A notice records an allegation. It does not establish liability.

Classification changes can also manufacture apparent trends. New York City began classifying claims about terms and conditions of employment as Labor and Employment claims in fiscal 2019. Earlier matters remained under prior personal-injury civil-rights or law salary categories while they moved toward resolution. The lifecycle and classification rules belong in the evidence record, not a technical appendix.

A reusable diligence worksheet

• Exact legal entity, department, event family, and source owner
• Document date, period covered, and separate status date
• Incident, filing, resolution, and payment dates where available
• Metric definition, denominator, comparison group, and exclusions
• Finding or allegation and management response
• Authorized corrective action and implementation dependency
• Later independent follow-up status and supporting evidence
• Current target date, open questions, and conclusions explicitly excluded

What the method can establish

• A requirement existed, an auditor documented a weakness, or management agreed to act.
• A governing body authorized a corrective action or later independent review accepted implementation evidence.
• Work remained past due, a target date was unknown, or rollout was incomplete.
• A payment total included legacy cases, scheduled judgments, or classification effects.

What it cannot establish

• Future claim frequency, severity, expected loss, ultimate loss, or reserve adequacy
• Coverage, pricing, retention, rating, or underwriting recommendations
• Causation between a control change and a financial outcome
• Relative risk across municipalities with different operations and legal regimes
• Liability, damages, or loss arising from an allegation or filed claim

Sources and method

Sources were checked through August 3, 2026. The sequence records requirement, finding, commitment, authorized action, independent status, and claims lifecycle as different event types. Absence from these selected sources is not evidence that an event did not occur.

1. California Code of Regulations, Title 8, Section 3203.
2. San Diego Performance Audit of Workplace Safety and Workers' Compensation, May 9, 2022.
3. San Diego Audit Recommendation Follow-Up Report, April 9, 2026, status through December 31, 2025.
4. San Diego Ordinance O-22041, final passage January 21, 2026.
5. New York City Comptroller FY2023 Annual Claims Report, published April 16, 2024.
6. New York City Comptroller Claims Dashboard Overview, updated April 21, 2025.

This is a public-record diligence-method example. It is not actuarial, insurance, underwriting, legal, financial, investment, claims, reserve, or rating advice.