1

M E M O R A N D U M

EUGENE WATER & ELECTRIC BOARD

TO: Commissioners Simpson, Helgeson, Manning, Mital and Brown

FROM: Sue Fahey, CFO; Susan Eicher, Accounting and Treasury Supervisor

DATE: September 23, 2016

SUBJECT: 2015 Audit Management Letter Update

OBJECTIVE: Information Only As part of the annual process, attached is the end of year status report on the comments from 2015 External Audit Management Letter.

Communication to Those Charged with Governance and Internal Control Related Matters

Eugene Water & Electric Board

December 31, 2015

1

COMMUNICATIONTOTHOSECHARGEDWITHGOVERNANCEANDINTERNALCONTROLRELATEDMATTERS

TotheBoardofCommissionersEugeneWater&ElectricBoardDearCommissioners:WehaveauditedthefinancialstatementsofEugeneWater&ElectricBoard(EWEBortheBoard)asofand for theyearendedDecember31,2015andhave issuedourreport thereondatedMarch4,2016.Professionalstandardsrequirethatweprovideyouwiththefollowinginformationrelatedtoouraudit.OUR RESPONSIBILITY UNDER AUDITING STANDARDS GENERALLY ACCEPTED IN THE UNITEDSTATESOFAMERICAAs stated in our engagement letter dated February 2, 2016, our responsibility, as described byprofessional standards, is to form and express an opinion about whether the financial statementsprepared by management with your oversight are fairly presented, in all material respects, inconformitywithU.S.generallyacceptedaccountingprinciples.Ourauditofthefinancialstatementsdoesnotrelieveyouormanagementofyourresponsibilities.Our responsibility is to plan and perform the audit in accordance with generally accepted auditingstandardsandtodesigntheaudittoobtainreasonable,ratherthanabsolute,assuranceaboutwhetherthe financial statements are free ofmaterial misstatement. An audit of financial statements includesconsiderationofinternalcontroloverfinancialreportingasabasisfordesigningauditproceduresthatare appropriate in the circumstances, but not for the purpose of expressing an opinion on theeffectiveness of the Board’s internal control over financial reporting. Accordingly, we considered theBoard’sinternalcontrolsolelyforthepurposesofdeterminingourauditproceduresandnottoprovideassuranceconcerningsuchinternalcontrol.Wearealsoresponsibleforcommunicatingsignificantmattersrelatedtothefinancialstatementauditthat, in our professional judgment, are relevant to your responsibilities in overseeing the financialreportingprocess.However,we arenot required to designprocedures for thepurpose of identifyingothermatterstocommunicatetoyou.PlannedScopeandTimingoftheAudit

WeperformedtheauditaccordingtotheplannedscopeandtimingpreviouslycommunicatedtoyouinourplanningmeetingonDecember1,2015.

2

SignificantAccountingPoliciesManagement is responsible for the selection and use of appropriate accounting policies. ThesignificantaccountingpoliciesusedbytheBoardaredescribedinNote1tothefinancialstatements.TheBoardadoptedthefollowingnewaccountingpronouncementinthecurrentyear:Effective July 1, 2014, the Board adopted GASB Statement No. 68, Accounting and FinancialReportingforPensionsaswellasGASBStatementNo.71,PensionTransitionforContributionsMadeSubsequenttotheMeasurementDate–anAmendmentofGASBStatementNo.68.GASB68providesguidanceforaccountingfornetpensionliabilities,includingdefinitionofbalancestobeincludedindeferredinflowsanddeferredoutflowsofresources.PreviousstandardsdefinedpensionliabilitiesintermsoftheAnnuallyRequiredContribution.StatementNo.68definesthenetpensionliabilityastheportion of the actuarial present value of projectedbenefit payments that is attributed to pastperiods of employee service, net of the pension plan’s fiduciary net position. Statement No. 68includes recognition of deferred inflows and outflows of resources associatedwith the differencebetween projected and actual earnings on pension plan investments. These differences are to berecognized in pension expense using a systematic and rational method over a closed five‐yearperiod.TheimplementationofStatementNo.68resultedinanadjustmenttothenetpensionasset/liabilityandtherecordingofdeferredinflowsandoutflowsforthetwoyearspresented.TheBoardhas elected to apply regulatory accounting and defer the non‐cash portion of pension expenseconsistentwithrate‐makingactivities.No other new accounting policieswere adopted and therewere no changes in the application ofexistingpoliciesduringfiscalyear2015.WenotednotransactionsenteredintobytheBoardduringtheyear forwhich there isa lackofauthoritativeguidanceor consensus.Therearenosignificanttransactionsthathavebeenrecognizedinthefinancialstatements inadifferentperiodthanwhenthetransactionoccurred.

AccountingEstimates

Accountingestimatesareanintegralpartofthefinancialstatementspreparedbymanagementandare based on management’s knowledge and experience about past and current events andassumptionsaboutfutureevents.Certainaccountingestimatesareparticularlysensitivebecauseoftheir significance to the financial statements and because of the possibility that future eventsaffectingthemmaydiffersignificantlyfromthoseexpected.Themostsignificantestimatesaffectingthefinancialstatementsareasfollows:

UnbilledRevenue–Unbilledrevenue isameasureofrevenueearnedthroughtheendofthereportingperiodthathasyettobebilled.Thisgenerallyrepresentsaccountswithbillingcyclesthat start in the reporting year and end in the subsequent year.We have evaluated the keyfactorsandassumptionsusedtodevelopunbilledrevenueindeterminingthatitisreasonableinrelationtothefinancialstatementstakenasawhole.

3

Allowance forDoubtfulAccounts – This represents an estimate of the amount of accountsreceivablethatwillnotbecollected.Wehaveevaluatedthekeyfactorsandassumptionsusedtodeveloptheallowanceindeterminingthatitisreasonableinrelationtothefinancialstatementstakenasawhole.RecoveryPeriods for the Cost ofPlant – This represents the depreciation of plant assets.Management’s estimate of the recovery periods for the cost of plant is based on regulatory‐prescribeddepreciationrecoveryperiods.Wehaveevaluatedthekeyfactorsandassumptionsusedtodeveloptherecoveryperiodsindeterminingthattheyarereasonableinrelationtothefinancialstatementstakenasawhole.

OtherPost‐employmentBenefitObligations–Thisrepresentstheamountofannualexpenserecognized for post‐employment benefits. The amount is actuarially determined, withmanagementinput.NoliabilityisrecognizedinEWEB’sfinancialstatementsbecausetheannualrequired contribution, as actuarially determined, is transferred to an external trust.We haveevaluatedthekeyfactorsandassumptionsusedtodeveloptheannualexpenseindeterminingthatitisreasonableinrelationtothefinancialstatementstakenasawhole.Mark‐to‐MarketAdjustment – Certain derivative instruments aremarked tomarket at yearend.However,theimpacttothestatementofrevenues,expenses,andchangesinnetpositionisdeferredinaccordancewithGAAP.Wehaveevaluatedthekeyfactorsandassumptionsusedtodevelop year‐end amounts and have determined that they are reasonable in relation to thefinancialstatementstakenasawhole.Pension Asset (Liability) and Related Pension Expense – This represents the amount ofannualexpenserecognizedforpensionsandtherelatedpensionassetorliability.Theamountisactuariallydetermined,withOPERSmanagementinput.Wehaveevaluatedthekeyfactorsandassumptionsusedtodeveloptheannualexpenseindeterminingthatitisreasonableinrelationtothefinancialstatementstakenasawhole.

FinancialStatementDisclosures

The disclosures in the financial statements are consistent, clear, and understandable. Certainfinancial statement disclosures are particularly sensitive because of their significance to financialstatement users. Significant disclosures include: Note 2 – Power Risk Management, Note 17 –CommitmentsandContingenciesandNote14–RetirementBenefits.

4

AuditAdjustments/PassedAdjustmentsAuditAdjustments–Forpurposesofthisletter,professionalstandardsdefineanauditadjustmentasaproposedcorrectionofthefinancialstatementsmadesubsequenttothestartofauditfinalfieldwork.AnauditadjustmentmayormaynotindicatemattersthatcouldhaveasignificanteffectontheBoard’sfinancialreportingprocess(thatis,causefuturefinancialstatementstobemateriallymisstated).

Noauditadjustmentswerenotedontheelectricorwatersystemsinthecurrentyear.PassedAdjustments–Passedadjustmentsare thoseentries foundduringthecourseof theauditthat management has decided to not post to the financial statements of the Board. It has beenconcludedbymanagement,andagreeduponbyMossAdams,thattheadjustmentsareimmaterialtothefinancialstatementsasawhole.Nopassedadjustmentswerenotedontheelectricorwatersystemsinthecurrentyear.

SignificantDifficultiesEncounteredinPerformingtheAuditWe encountered no significant difficulties in dealing with management in performing andcompletingouraudit.

DisagreementswithManagement

For purposes of this letter, professional standards define a disagreementwithmanagement as afinancial accounting, reporting, or auditing matter, whether or not resolved to our satisfaction,concerning a financial accounting, reporting, or auditing matter that could be significant to thefinancial statementsor theauditor’s report.Wearepleased to report thatnosuchdisagreementsaroseduringthecourseofouraudit.

ManagementRepresentations

WehaverequestedcertainrepresentationsfrommanagementthatareincludedinthemanagementrepresentationletterdatedMarch4,2016.

ConsultationwithOtherAccountants

In some cases, management may decide to consult with other accountants about auditing andaccountingmatters, similar to obtaining a “second opinion” on certain situations. If a consultationinvolvesapplicationofanaccountingprincipletotheBoard’sfinancialstatementsoradeterminationofthetypeofauditor’sopinionthatmaybeexpressedonthosestatements,ourprofessionalstandardsrequiretheconsultingaccountanttocheckwithustodeterminethattheconsultanthasalltherelevantfacts.Toourknowledge,therewerenosuchconsultationswithotheraccountants.

IndependenceMossAdamsisindependentinappearanceandfactwithrespecttoEugeneWater&ElectricBoard.

5

COMMUNICATIONOFINTERNALCONTROLRELATEDMATTERSInplanningandperformingourauditofthefinancialstatementsofEWEBasofandfortheyearendedDecember31,2015, in accordancewithauditing standards generally accepted in theUnitedStatesofAmerica,weconsideredtheBoard’sinternalcontroloverfinancialreporting(internalcontrol)asabasisfor designing our auditing procedures for the purpose of expressing our opinion on the financialstatements,butnotforthepurposeofexpressinganopinionontheeffectivenessoftheBoard’sinternalcontrol.Accordingly,wedonotexpressanopinionontheeffectivenessoftheBoard’sinternalcontrol.Ourconsiderationof internalcontrolwasforthelimitedpurposedescribedinthefirstparagraphandwasnotdesignedtoidentifyalldeficienciesininternalcontrolthatmightbematerialweaknessesandtherefore,materialweaknessesmayexist thatwerenot identified.Given these limitations,duringourauditwedidnotidentifyanydeficienciesininternalcontrolthatweconsidertobematerialweaknesses.A deficiency in internal control exists when the design or operation of a control does not allowmanagementoremployees,inthenormalcourseofperformingtheirassignedfunctions,toprevent,ordetect and correct misstatements on a timely basis. A material weakness is a deficiency, or acombinationofdeficiencies,ininternalcontrol,suchthatthereisareasonablepossibilitythatamaterialmisstatementoftheentity’sfinancialstatementswillnotbeprevented,ordetectedandcorrectedonatimelybasis.In addition to the required communications, we have identified the following matters for yourconsideration.Our recommendations are basedon observations and testingduring the course of ouraudit. These recommendations should be evaluated by management and the Commissioners forimplementationandEWEBshouldconductacostbenefitanalysis includingconsiderationof therisksfortherecommendedaction.OtherMatters

OverheadratecalculationandapplicationWenotedthattheWAMsystemdoesnotcurrentlyhavethecapabilitytoautomaticallyallocateandapplyoverheadtoworkorderseachmonth.Instead,theplantaccountantexportstheworkorderactivityeachmonthandperformsamanualcalculationoutsideofWAMtoapplyoverheadtoeachworkorder.Theupdatedspreadsheetwiththeoverheadallocationisthenre‐uploadedintoWAMtoensuretheoverheadadjustmentsareproperlyreflectedoneachworkorder.Wealsonotedthatthereisnodetailedreviewofthiscalculationtoensurethatthecorrectoverheadrate was applied and that the allocation was performed completely and accurately. WerecommendthatifmanagementisnotabletoaddfunctionalitytotheWAMsystemtoallowforthis calculation to be done automatically, that a detailed review of themanual calculation becompletedonamonthlybasisbysomeoneotherthantheplantaccountant.

6

Management response – Susan Eicher, General Accounting and TreasurySupervisorFull automation of the overhead process requires enhancements from Oracle. Untilenhancementsinoverheadfunctionalityareavailable,theprocessofapplyingoverheadwillbeautomatedasmuchas ispossibleusingstandardreportingandqueryingtools.Additionally,therewillbecrosstrainingforthisfunctionduring2016thatwillallowforonepersontopreparetheentryandanothertoreview.2016 Update ‐Management response – Susan Eicher, General Accounting andTreasurySupervisorAutomationofoverheadapplicationprocessesthatdon’trequiretheenhancementfromOraclehavebeencompleted,andcrosstrainingofstaffisinprocess.

ConservationloanreceivablereconciliationDuringtheprocessofauditingconservationloans,wenotedthatthedetailedloanreconciliationto the general ledger for 2015was only performed on an annual basis. This reconciliation isfromtheCIStothegeneralledgeronly,andnoreconciliationofthedetailedloandisbursementsand repayments received ismaintainedwithin the department responsible for approving theloans. As a best practice, we recommend that loan detail of disbursements and repaymentsreceivedbemaintainedandreconciledtothegeneralledgeronamonthlybasisbythepersonnelresponsibleformaintainingtheconservationloansystemsothatallerrorsmaybereconciledinatimelymanner.Also,tostrengthensegregationofduties,wewouldrecommendthatloansbeenteredintothesystembypersonnelwhoarenotresponsibleforapprovalorprocessing.

Managementresponse–MarkFreeman,EnergyManagement&CustomerServiceManagerThe reconciliation process used to bemaintained by EMS staff. The process changedwhen finance and reporting mechanisms changed due to WAM implementation.Managementrecognizesthatreconciliationneedstobedoneonamoreconsistentbasis.EMS and Accounting staff are working together to make this happen. Managementintends that this joint effort continue, and that the frequency increase to a monthlyprocess. EMS and Accounting staff are committed to developing and maintaining amonthly reconciliation process that uses expertise from both areas, to reconcile allloans. There are multiple levels of segregation and internal controls built aroundentering loans into CIS and loan disbursement. Those include a new verification thatoccursbetweenEnergyInsightandCISasanelectronicstopifthoseloansdonotmatchbothsystems.Theinternalcontrolsalsoincludemultiplelayersofreviewpriortofinalloandisbursementaswell.Managementintendstodocumentthecurrentcontrolsandensuretheyremaininplaceinthefuture.

7

2016Update‐Managementresponse–MarkFreeman,CustomerSolutionsManager;SusanEicher,GeneralAccountingandTreasurySupervisorEMS and Accounting staff have worked together and documented the reconciliationprocess which is being done monthly. There are multiple levels of segregation andinternal controls built around entering loans into CIS and loan disbursement. ThoseincludeanewvalidationthatrequiresEnergyInsightandCIStomatchinbothsystems.The internal controls also include multiple layers of review prior to final loandisbursement.Managementhasdocumentedthecurrentcontrols,andwillensuretheyremaininplaceinthefuture.

ChangeManagementThroughdiscussionswithmanagementandbaseduponourobservations,wenoted therearedifferent teams that support application changes and thatdocumentation andevidence is notalwaysretainedandisnotalwaysconsistent fromonechangetothenext.Whilemanagementhas formalizedchangemanagementpoliciesandprocedures, theactivitiesdonotconsistentlyfollowthepoliciesandprocedures.Werecommendthatmanagementmonitorandenforcetheformalizeddocumentedprocedurestoensurethatdifferentteamsareconsistentlyperformingthesameactivities.

Managementresponse–MattBarton,InformationServicesManagerEWEBagreeswiththisrecommendationandwillcontinuetheworkthatbeganin2015toaddressthesecommentsrelatedtoChangeManagement.2016Update‐Managementresponse–MattBarton,InformationServicesManager InformationserviceshashiredaQualityAssurance&ReleaseCoordinator, assignedaSupervisortooverseechangemanagement,andhasimplementedchangemanagementpoliciesandproceduresforsystemandreportchanges.EWEBwillcontinuetoimproveandimplementChangeManagementpoliciesandprocedures

UserAccessConflictsDuringourreviewofITuseraccess,wenotedthatseveralusershaveaccesstomorethanoneoftheapplicationswereviewed(WAM,SmartStream,andCIS),thuspotentiallyallowingaccesstodo more than what should be allowed. Due to the number of users within each system, werecommendthatmanagementconsiderperforminganassessmentofalluseraccessrightsandcompare access across applications. This review should consider users within SmartStream,WAM,andCIS toensure thateachuser isgrantedappropriate accessbasedon their job title.Correspondingly,managementshouldperformthe reviewtoensure there isno inappropriateaccessacrosssystemsallowingausertooverridecontrols.

8

Managementresponse–MattBarton,InformationServicesManagerEWEBagreeswiththisrecommendationandwillprioritizethiswork intotheISworkplan for 2016.Once theprocess is in placeEWEBwill conduct the reviewmentionedabove,atminimum,onanannualbasis.2016Update‐Managementresponse–MattBarton,InformationServicesManagerInformationServiceshasimplementedaprocesstoperformannualmonitoringforuseraccess conflicts within and across system platforms. Any user access conflicts areresolvedbasedonbusinessneedandjobresponsibilities.

Inaddition,duringourreviewofuseraccessspecificallywithintheWAMsystem,wenotedthat10 active accountswere assignedwith admin access. This allows for full access and rights towork orders and inventory within WAM. We noted that two of the accounts belonged toconsultantswhonolongerworkwithEWEB,oneaccountwasagenericuseraccount,andtheremaining seven accounts belong to core WAM team members. We recommend thatmanagement perform a user review on at least an annual basis to ensure user accounts arelimitedtoactiveemployeeswhorequireadminaccesstoWAM.

Management response – Susan Eicher, General Accounting and TreasurySupervisorManagement will complete a review of administrator access, and will terminate anyaccess that is not deemed necessary, or that creates conflicts with internal controls.Goingforward,areviewwillbeperformedannually.2016 Update ‐Management response – Susan Eicher, General Accounting andTreasurySupervisorA review of administrator access has been completed, and the number of userswithadministrativeaccesshasbeenreducedtothosewhohaveanessentialbusinessneed.

Finally, during our review of user access specificallywithin the CIS,we noted that five usershave access to key roles within CIS including adjustment posting, cash accounting, customerservice,ratesadministrationandsystemadministration.Alloftheseusersarebusinesssupportanalystswhomanagementstatesrequiresuchaccesstotheserolesfortheirday‐to‐dayduties.However, this poses a risk if user activity performed by these individuals is not properlymonitored.We recommend thatmanagement continually assess the need to grant all five oftheseemployeeswithaccesstothesevariousareaswithintheCIS.

Managementresponse–MarkFreeman,EnergyManagement&CustomerServiceManagerManagement recognizes the concern of potential risk in providing 5 users with theaccesslevelsstatedabove.CurrentlyEWEBisintheplanningphaseofareplacementCISsystem project. To be able to successfully execute on this project deliverable while

9

maintainingcontinuedseamless systemsupport to thecurrentCISsystem ithasbeennecessary to increase the FTEof business support analystswith two limiteddurationpositions.The incumbentsof thesepositionsbegan in late2015andwill serve in thiscapacity no longer than 3 years. This provides the additional capacity required tosupportexistingoperationswhilethebusinesssupportanalystswhoarelongerservingsubjectmatterexpertsareabletosupporttheproject.ItisanticipatedthatreductioninthetotalFTEwiththeseaccesspermissionwillreducethroughattritioninmidto late2017.TheCISreplacementprojectisscheduledtobecompletedbyYE2018.2016Update‐Managementresponse–MarkFreeman,CustomerSolutionsManagerManagement recognizes the concern of potential risk in providing 5 users with theaccesslevelsstatedabove.Thislevelofaccessisrequiredtosupportexistingoperationsand the CIS project. The total FTE with these access permissions will reduce in late2017.

The followingcommentsareupdates fromprioryear thatareon‐goingandupdates to theprioryearsignificantdeficiencies.Fullyresolve issuesnotedintheprioryearare includedinAppendixA.Pleasesee theprioryear letterdatedMarch27,2015 for fulldescriptionsof thematters listedbelowand inAppendixA.

Coordinationbetweenkeystakeholdersand lackofservice levelagreements– Intheprioryear, these issues were considered significant deficiencies. We have noted significantimprovementinthisarea,especiallyasitrelatestoWAM.Thoughthesewillalwaysbeareasofemphasis for theorganization, thecontinuous improvementhasresolvedourconsiderationofsignificantdeficienciesfortheseissuesinthecurrentyear.

Managementresponse–RogerGray,GeneralManagerThe WAM Business Stabilization Project was completed, but was extended in toSeptember 2015. This project focused on the highest priority issues which werecompleted.Thisprojectalsoidentifiedmanyissuesthatstillneedtobeaddressednowto optimize and improve overall organization performance. The system is stable andsupportedandwearenowturningtoimprovingbusinessprocessesthat interactwithWAM and reporting. This new effort has already been launched. On the positive sideWAMisgivingusbetterinsightintohowEWEBaccountsforandtracksassetsthatwehavehistoricallynothad.Servicelevelagreementshavebeencompletedforthecriticalsystems, including HRIS, Smart Stream; Allegro;WAM; CIS;Milestone; Lenel; GIS andOutlookemail.TheSLAworkplanrequired thatSLALeadsandSMEsproduceservicelevel agreements, up to and including successful sign off by all parties, and upload ofsignedagreementstoEWEB’sSharePointsiteuponcompletion.WorkwillcontinueonSLAsin2016.

10

2016Update‐Managementresponse–FrankLawson,GeneralManager Coordination and collaboration among key stakeholders has improved, and currentsystem projects, including the replacement of the CIS and HRIS systems, have beenstructuredtoincludeandinformkeystakeholdersthroughouttheprojects.Informationservicesstaffaretrainedandabletodeliverongoingmaintenanceandsupport,withoutcontinuedrelianceonthirdpartyvendors.TheWAMadvancementprojecthasresultedinincreasedsystemeffectivenessandefficiencies.Continuedworkwilloccuraspartofnormaloperations.

Internalauditdepartment–Theinternalauditdepartmentcontinuedtoevolveduring2015.With the departure of key individuals, the department was reorganized under the financedepartment as the finance staff have experience in internal controls assessment, design andtesting.WeencourageEWEBtocontinue toassess the internalauditdepartmentanddeveloproles and responsibilities within that department that will support and strengthen internalcontrolsthroughouttheOrganization.

Managementresponse–SusanFahey,FinanceManagerThe Enterprise Risk Department staff is currently working with divisions to identifyrisks which includes internal controls assessments. Once risks are identified andassessed,riskmanagementplanswillbedevelopedandmonitored.Additionally,severalpolicies and procedures (e.g., delegated authority, ethics, self‐insurance, power riskmanagement) have been, or are in the process of being, revised to strengthenoperationalproceduresandcontrols.Thedepartmentalsohasanonlineintakesitethatallowsemployeestosuggestinternalcontrolandcomplianceimprovements.2016Update‐Managementresponse–SusanFahey,ChiefFinancialOfficerEnterpriseRiskDepartmentstaffcontinuestoworkwithdivisionstoidentifyandassessrisksaswellastherelatedmanagementofthoserisks.Severalpoliciesandprocedureshavebeenupdated to strengthen internal controls.A recruitment is inprocess for anexperienced financial internal auditor to supplement the skills of the current InternalAuditorwhosefocusisevaluatingIScontrols.

CrosstraininganddocumentationofpoliciesandproceduresforWAMWe have noted through our testing that there has been some improvement in this area,however,additionaldocumentationandcrosstrainingisstillneeded.Wehavenotedthatthisisinthe2016goalsprovidedtousbymanagement.

Managementresponse–SusanEicher,GeneralAccountingandTreasurySupervisorDuring2015,asapartoftheWAMBusinessStabilizationProject,additionaltraininghasbeendeliveredtoendusersforkeymodulesofWAM.ISstaffhavereceivedtraininganddemonstrated the ability to support the systemwithminimal assistance from outsideresources. System and process documentation is underway and will be continuing as

11

processes are refinedand improvementsare implemented.Management acknowledgesthatcross training forskillsof thecore teamandotherkeysystemuserswill continueduring 2016. Ongoing work will include an emphasis on documentation of processesperformedbykeysystemusers.2016 Update ‐Management response – Susan Eicher, General Accounting andTreasurySupervisorTheWAMStabilizationProjecthasended,andthenextphase, theWAMAdvancementProject,hascollectedtrainingneedsfromstaff,anddeliveredgroupandindividualizedtraining.Crosstrainingofcoreteammembersisinprocessandwillbeongoing.AspartoftheWAMAdvancementProjectandcrosstraining,documentationisbeingdevelopedandupdated.

AnalysisofrolesandpermissionswithinITsystemsWeupdatedourtestingofrolesandpermissionwithITsystemsduringthecurrentyearaudit.SeeUserAccessConflictsunderthecurrentyearcommentsforourrecommendations.

Managementresponse–MattBarton,InformationServicesManagerPleaseseetheresponsetoUserAccessConflictsunderthecurrentyearcomments.

CybersecurityprotocolsWesawan increaseofprotocols across theOrganization in regard to cybersecurityprotocolsand have no further current recommendations over this area, other than the ChangeManagement recommendation listed in the current year comments. However, as this is anemerging area with a significant amount of public and federal scrutiny, we recommendmanagementcontinuesignificantdiligenceinthisarea.

Managementresponse–MattBarton,InformationServicesManagerEWEBagreeswith this recommendationandwill continue itsefforts in cybersecurity.PleaseseetheresponsetoChangeManagementunderthecurrentyearcommentsforadditionaldetail.

VersioncontrolPleaseseeChangeManagementunderthecurrentyearcommentsforourrecommendations.

Managementresponse–MattBarton,InformationServicesManagerPleaseseetheresponsetoChangeManagementundercurrentyearcomments.

12

InventorypurchasesoutsideoftheinventorysystemThe trackingandpurchasingof inventory itemsappears tohavebeenresolved in thecurrentyear. However,management is still assessing how to handle the inventory thatwas found in2013.Assuch,werecommendcontinuedassessmentoftheinventoryfoundin2013.

Managementresponse–SusanFahey,FinanceManagerThewarehousejoinedtheFinanceDivisioninSeptember2015anddevelopedaremoteinventoryprojectplan.Eachremotesitehasremovedobsoleteitems,identifieditemstobe included in inventory, added several stock items into the system and completed aphysicalcount.Theworkisestimatedtobeapproximately50%completewithJune30,2016 as the expected completion date. In addition to the remote inventorywork, theinventorypolicyisinthefinalrevisionstageandincludesstrengthenedinternalcontrollanguage.2016Update‐Managementresponse–SusanFahey,ChiefFinancialOfficer

Staff have completed the remote inventory project plan. Inventory items have beenenteredinthesystem,andconsumablesarebeingmanagedeitherbysitestafforathirdparty. TrainingandsupportforremoteinventorytransactionshavebeenprovidedbyCentral Warehouse staff. Approximately 2000 stock units have been added and arebeingmanagedbysitesupervisors.Eachquarter,centralwarehousestaffcountremoteinventory to verify materials are being managed in accordance with the recentlyadoptedInventoryManagementPolicy.

TheBoard’swrittenresponsestotheotherrecommendationsidentifiedinourauditwerenotsubjectedtotheauditingproceduresappliedintheauditofthefinancialstatementsand,accordingly,weexpressnoopiniononit.

13

*****

ThiscommunicationisintendedsolelyfortheuseoftheBoardandmembersofmanagementandisnotintendedtobeandshouldnotbeusedbyanyoneotherthanthesespecifiedparties.Sincerely,Portland,OregonMarch4,2016

APPENDIXAPRIORYEARCONTROLDEFICIENCIESRESOLVEDIN2014

SupportforOracleapplicationanddatabaseenvironmentsIn theprior year,wehadnoted that EWEB significantly expanded its use ofOracle as a result of therecentWAMsystemimplementation.However,resourcesonstafftoadequatelysupporttheapplicationanddatabaseenvironmentswerelimited.Wenotedsignificantimprovementinthisareaandconsiderthisissueresolved.DataprotectionmanagementpolicyanddataclassificationproceduresEWEBcontinuedtoclassifycriticalsystemin2015anddocumentpolicyandprocedurestoensurethesecurity and confidentiality of information. Though we consider this comment resolve, please seeChange Management in the current year comments for additional recommendations overdocumentation.ConflictsofinterestrelatedtotheinternalauditfunctionBased on our testing, we believe the conflicts of interest that were occurring in the internal auditdepartmentareresolved.SystempasswordsWe had no ongoing issues or recommendations for system passwords, therefore, we consider thisresolved.TimelyreconciliationofbankreconciliationsBankreconciliationsweretimelyreconciledduring2015.Weconsiderthismatterresolved.CustomeradjustmentsreportWe found that customer adjustment reports are being reviewed at the appropriate level in a timelymanner.Weconsiderthismatterresolved.