Summary#

Calgary City Council approved the 2026 Mid-Year Principal Corporate Risk Report on July 28, 2026, as a consent-agenda item. Council received it for information and the Corporate Record; it did not approve a new risk-management program or direct changes to City services. Council also directed the Chief Administrative Officer to report back on two cybersecurity audits and kept specified discussions and attachments confidential until a review by June 30, 2029.

• The Chief Administrative Officer must bring a progress update on the Cybersecurity Detect Posture Audit and Cybersecurity Governance Audit to the Audit Committee’s September 10, 2026 meeting.
• The closed-meeting discussions and confidential Attachments 3 and 5 must remain confidential until their review by June 30, 2029.
• City staff say the report adds Cyber Risk as a separate Principal Corporate Risk for future reporting. That is a change in how the City presents its risks, not a Council-approved response to the risk.

What it means for you#

• Calgarians: The decision does not directly change eligibility for City services, service levels, taxes, or rules for residents and businesses.
• City management: The Chief Administrative Officer must provide the cybersecurity audit update by the stated meeting date.
• Public access to information: The specified discussions and attachments remain confidential until the review date. Other material in the report is not covered by this confidentiality direction.

Money#

City staff report no anticipated financial impact tied to the recommendations.

• No separate cost estimate for preparing the cybersecurity update is provided.

What is unclear#

• The public material does not provide the details in confidential Attachments 3 and 5, so the specific risk measures and technology-related risk updates cannot be assessed here.
• The decision does not set out what information the cybersecurity audit update must contain or what action, if any, Council or the Audit Committee must take after receiving it.

Case for#

• City staff say the report gives the Audit Committee an integrated view of risks and their connections, to support monitoring and management decisions.
• City staff say treating Cyber Risk as a separate risk will give it clearer focus in future updates.
• The required update creates a set date for the Audit Committee to receive progress information on two cybersecurity audits.

Case against#

• The confidentiality direction limits what the public can see about some risk information until at least the scheduled review.
• The decision receives the wider risk report for information; it does not require specific action to address the risks described in it.