INTRODUCTION:
Background
State law authorizes the California State Auditor (State Auditor) to develop a state high-risk government agency audit program (high‑risk program). Our office implemented this program to improve the operation of state government by identifying, auditing, and recommending improvements to state agencies and statewide issues at high risk for waste, fraud, abuse, or mismanagement or for having major challenges associated with their economy, efficiency, or effectiveness. In accordance with this statutory authority, the State Auditor adopted regulations in 2016 that further define the high-risk program. These regulations provide the criteria we used in determining the list of state high-risk agencies and statewide issues we present in this report.Criteria for Determining Whether a State Agency or Statewide Issue Merits a High‑Risk Designation
State regulations outline the conditions under which an agency or issue may be added to the State Auditor’s high-risk list. All four of the following conditions must be present for us to assign the high‑risk designation:- Potential waste, fraud, abuse, or mismanagement or impaired economy, efficiency, or effectiveness that may result in serious detriment to the State or its residents.
- The likelihood of waste, fraud, abuse, or mismanagement or the likelihood of impaired economy, efficiency, or effectiveness causing harm is so great that this likelihood constitutes a substantial risk of detriment to the State or its residents. 1
- The state agencies that are affected by or responsible for resolving the waste, fraud, abuse, or mismanagement or the impaired economy, efficiency, or effectiveness are not taking adequate corrective actions to prevent the risk or its effects.
- An audit and the agencies’ implementation of the resulting recommendations may significantly reduce the substantial risk of serious detriment to the State or its residents.
Removal of High-Risk Designation
We remove the high-risk designation under any of the following circumstances:- A change in circumstances has resulted in the risk no longer presenting the potential for serious detriment to the State or its residents.
- The agency has taken sufficient corrective action to prevent or mitigate the risk of harm.
- The risk presented by the agency or issue is not likely to be reduced by performing additional audit work.
State High-Risk Reports
Government Code section 8546.5 authorizes the State Auditor to audit and to publish audit reports on any state agency that it identifies as high-risk. In May 2007, we issued Report 2006‑601, which provided an initial list of high-risk state agencies and statewide issues. We have since issued several reports updating the list of those agencies and issues that are high-risk. Further, we include on our website a list of all audits that we are performing, including those of high-risk state agencies and statewide issues.To update our assessment of high-risk state agencies and statewide issues, we interviewed knowledgeable staff at the responsible state agencies to gain perspective on the extent of the risks the State faces. We also reviewed the efforts that staff at the agencies said were underway and were intended to mitigate the identified risks. In addition, we reviewed reports and other documentation relevant to the issues. Finally, we conferred with agencies and interested parties, such as the Department of Finance, the Legislative Analyst’s office, and the Public Policy Institute of California. Each of the entities we conferred with provided its perspective on high-risk areas facing the State.