State law authorizes the California State Auditor (State Auditor) to develop a state high risk program and to issue reports with recommendations for improving state agencies and addressing statewide issues it identifies as high‑risk. State law also authorizes the State Auditor to require the responsible state agencies1 to report periodically on the status of their implementation of our recommendations. In accordance with this statutory authority, the State Auditor adopted regulations in 2016 that further define our state high risk program. As outlined here, these regulations provide the criteria we used in determining the state high risk list we present in this report. According to the criteria, a state agency is responsible for a statewide issue if it is responsible for a portion of the issue or could be tasked with resolving a portion of the issue.
Criteria for Determining Whether a State Agency or Statewide Issue Merits Designation as High‑Risk
High‑risk agencies and issues include not only those that are particularly vulnerable to fraud, waste, abuse, and mismanagement but also those that have major challenges associated with their economy, efficiency, or effectiveness. In addition, all four of the following conditions must be present for the State Auditor to designate an agency or issue as high‑risk:
- The potential waste, fraud, abuse, mismanagement, or impaired economy, efficiency, or effectiveness may result in serious detriment to the State or its residents.
- The likelihood of this serious detriment is great enough to present a substantial risk to the State or its residents.
- The agency is not taking adequate corrective actions to prevent the substantial risk of serious detriment to the State or its residents.
- The substantial risk of serious detriment to the State or its residents may be significantly reduced by our performance of an audit and issuance of recommendations that are implemented to control or eliminate the causes of risk.
For both state agencies and statewide issues, we consider a number of factors in determining the substantiality of risk, including whether the risks are already causing detriment to the State or its residents, whether those risks are escalating, and whether changes in circumstances are likely to cause detriment. We also assess different factors to determine whether the risks will result in serious detriment, such as loss of life, injury, or reduction in residents’ overall health or safety; impairment of the delivery of government services; significant reduction of overall effectiveness or efficiency of state government programs; and impingement of citizens’ rights. Finally, we evaluate whether the agency has taken adequate measures to correct previously identified deficiencies or whether the State has taken measures to reduce the risks posed by the statewide issues. In all cases, our professional staff make the final determination of risk level based on their independent and objective judgment. Appendix A further describes the factors we consider in making this determination. It also outlines the factors we consider when evaluating whether to remove an issue or agency from our high risk list.
State High Risk Reports
Government Code section 8546.5 authorizes the State Auditor to audit any state agency it identifies as high‑risk and to issue related audit reports at least once every two years. In May 2007, we issued a report that provided an initial list of high‑risk issues and agencies, and we issued update reports on the status of those issues and agencies, as well as any additions, in June 2009, August 2011, and September 2013.
Since our September 2013 report, High Risk: The California State Auditor’s Updated Assessment of High‑Risk Issues the State and Selected State Agencies Face, Report 2013‑601 (September 2013 report), we have continued to evaluate issues facing the State for inclusion on our high risk list. For example, in December 2013, we issued a separate report, New High Risk Issue: Providing a High Quality and Affordable Public Education Presents Significant Challenges, Report 2013‑604 (December 2013 report), in which we designated kindergarten through 12th grade (K–12) education as high‑risk because of significant policy changes, including the State’s implementation of the local control funding formula (LCFF) and common core state standards. In that report, we also highlighted the impact that rising tuition costs and budget constraints had on residents’ access to California’s public universities. In 2015 we released several individual high risk update reports on a number of issues and agencies, such as the California Department of Public Health (Public Health), public safety realignment and the California Department of Corrections and Rehabilitation (Corrections), and oversight of the State’s information technology (IT) by the California Department of Technology (Technology Department).
To update our analysis of high‑risk issues and entities, we interviewed knowledgeable staff at the responsible agencies to gain their perspectives on the extent of the risks the State faces. We also reviewed any efforts underway that the staff at the agencies identified as mitigating those risks. In addition, we reviewed reports and other documentation relevant to the issues.