State law authorizes the California State Auditor (State Auditor) to develop a state high-risk government agency audit program (high‑risk program). Our office implemented this program to improve the operation of state government by identifying, auditing, and recommending improvements to state agencies and statewide issues at high risk for waste, fraud, abuse, or mismanagement or for having major challenges associated with their economy, efficiency, or effectiveness. In accordance with this statutory authority, the State Auditor adopted regulations in 2016 that further define the high-risk program. These regulations provide the criteria we used in determining the list of state high-risk agencies and statewide issues we present in this report.

Criteria for Determining Whether a State Agency or Statewide Issue Merits a High‑Risk Designation​

State regulations outline the conditions under which an agency or issue may be added to the State Auditor’s high-risk list. All four of the following conditions must be present for us to assign the high‑risk designation:
  • Potential waste, fraud, abuse, or mismanagement or impaired economy, efficiency, or effectiveness that may result in serious detriment to the State or its residents.
  • The likelihood of waste, fraud, abuse, or mismanagement or the likelihood of impaired economy, efficiency, or effectiveness causing harm is so great that this likelihood constitutes a substantial risk of detriment to the State or its residents. 1
  • The state agencies that are affected by or responsible for resolving the waste, fraud, abuse, or mismanagement or the impaired economy, efficiency, or effectiveness are not taking adequate corrective actions to prevent the risk or its effects.
  • An audit and the agencies’ implementation of the resulting recommendations may significantly reduce the substantial risk of serious detriment to the State or its residents.
When assessing both state agencies and statewide issues, we consider a number of factors to determine whether there is substantial risk to the State or its residents. We consider whether the risks are already causing detriment, whether those risks are increasing, and whether changes in circumstances are likely to cause detriment. We also consider various factors to determine whether the risks may have serious effects, such as loss of life, injury, or a reduction in residents’ overall health or safety; impairment of the delivery of government services; significant reduction in the overall effectiveness or efficiency of state government programs; and infringement on citizens’ rights. Finally, in evaluating whether agencies have taken adequate measures to correct previously identified deficiencies, or whether the State has taken measures to reduce the risks posed by the issues, we consider factors such as whether the agencies have demonstrated a strong commitment to controlling or eliminating the risk and whether they have made significant progress through action already taken to control or eliminate the risk to the State. In all cases, our professional staff make the final determination of risk level according to their independent and objective judgment.

Removal of High-Risk Designation​

We remove the high-risk designation under any of the following circumstances:
  • A change in circumstances has resulted in the risk no longer presenting the potential for serious detriment to the State or its residents.
  • The agency has taken sufficient corrective action to prevent or mitigate the risk of harm.
  • The risk presented by the agency or issue is not likely to be reduced by performing additional audit work.
State regulations require us to use our professional judgment to determine whether to remove a high-risk designation. When we remove the high-risk designation for one of the reasons described above, we continue to monitor the issue or agency and, if the risk reoccurs, we will consider reinstating the high-risk designation according to the factors described earlier.

State High-Risk Reports​

Government Code section 8546.5 authorizes the State Auditor to audit and to publish audit reports on any state agency that it identifies as high-risk. In May 2007, we issued Report 2006‑601, which provided an initial list of high-risk state agencies and statewide issues. We have since issued several reports updating the list of those agencies and issues that are high-risk. Further, we include on our website a list of all audits that we are performing, including those of high-risk state agencies and statewide issues.
To update our assessment of high-risk state agencies and statewide issues, we interviewed knowledgeable staff at the responsible state agencies to gain perspective on the extent of the risks the State faces. We also reviewed the efforts that staff at the agencies said were underway and were intended to mitigate the identified risks. In addition, we reviewed reports and other documentation relevant to the issues. Finally, we conferred with agencies and interested parties, such as the Department of Finance, the Legislative Analyst’s office, and the Public Policy Institute of California. Each of the entities we conferred with provided its perspective on high-risk areas facing the State.