Audit: Oregon agencies vulnerable to waste and fraud
SALEM — Oregon has not prioritized internal audits at state agencies, leaving those agencies "more vulnerable to fraud, wasted taxpayer dollars, and other substantial risks," a new Secretary of State audit finds.
Internal auditors work for the agency they audit, and provide ongoing monitoring of agency activities, which can save money, improve agency programs and services and prevent future problems.
Agencies that spend at least $100 million every budget cycle, process $10 million in cash or cash equivalents annually, or have 400 or more full time equivalent staff are required by state law to establish, maintain and support an internal audit function.
External auditors, such as those based in the Secretary of State's Office, perform intermittent audits of state agencies and are not employed by those agencies.
Wednesday's report claims that internal auditing is "not prioritized or well understood by agency management and the Legislature," and has not been for more than 20 years.
"Policymakers face intense, competing demands for limited resources, and the priority of internal auditing in the state has diminished over time," auditors wrote. "Oregon is not alone in this regard, as internal auditing and investigations are among the first areas cut by agencies in many states facing fiscal challenges. However, this practice is counter-productive, as auditors are especially helpful to management in finding opportunities for agency improvement, cost savings and additional revenues — opportunities that become especially valuable in times of budget shortfalls."
Secretary of State auditors pointed to the Oregon Department of Energy as an example of an agency that could likely benefit from more robust internal auditing.
"The Oregon Department of Energy has long struggled to maintain audit staff and meet state requirements for internal audit work," auditors wrote. "...The agency has not performed a risk assessment or convened a meeting of its audit committee since 2015, and consistently has not met state requirements for audits completed. Yet the agency has faced challenges, such as fraud and waste related to Business Energy Tax Credits program that could have possibly been mitigated with dedicated audit resources."
And in some state agencies, internal auditors don't meet guidelines for independence from management, lowering their effectiveness.
The Secretary of State's Office also found that the Department of Administrative Services has failed to guide, manage or effectively coordinate state agency internal auditing functions.
DAS reports on internal audit activities are "often inaccurate, confusing and uninformative," the audit report contends.
The internal auditors the state does have can do their jobs better, the Secretary of State review found, but DAS can also provide more guidance to help maximize the impact of the internal auditors state government does have.
DAS has a five-year plan to tackle the work associated with the Secretary of State's audit recommendations, state Chief Operating Officer Katy Coba wrote in a response to the audit, addressed to audits division director Kip Memmott.
Top managers at DAS, the state's Chief Audit Executive, and the Chief Audit Executive Council plan to develop a "stronger and more informational" annual report on internal audit activities, review state administrative rules on internal auditing for possible changes and improving training materials for "productive audit committees."