State Leadership Accountability Act (slaa) Report

Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 December 24, 2025 Joe Stephenshaw, Director California Department of Finance 915 L Street Sacramento, CA 95814 Dear Director Joe Stephenshaw, In accordance with the State Leadership Accountability Act (Leadership Accountability), the Behavioral Health Services Oversight and Accountability Commission submits this report on the review of our internal control and monitoring systems for the biennial period ending December 31, 2025. Should you have any questions please contact Lauren Quintero, Acting Deputy Director of Administration and Performance Management, at (916) 605-8179, lauren.quintero@bhsoac.ca.gov. GOVERNANCE Mission and Strategic Plan The Behavioral Health Services Oversight and Accountability Commission, hereafter referred to as the Commission for Behavioral Health (CBH) or Commission, is committed to transforming California’s behavioral health system through community engagement, data-driven policy, and strategic partnerships. Its mission is to foster a comprehensive, integrated, and culturally responsive system that promotes resilience, recovery, wellness, and stigma-free inclusion for all Californians. The Commission advances this mission by: • Promoting behavioral health prevention, early intervention, and innovative services statewide • Supporting research-based, continuously evaluated behavioral health programs that improve quality of life • Investing in behavioral health initiatives that span the full continuum of care Since its inception, the Commission has directed over $442 million toward ten key initiatives, including: • Early Psychosis and Suicide Prevention • Youth and Older Adult Mental Health Page 1 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 • Crisis Continuum of Care (via the Mental Health Wellness Act and Full-Service Partnerships) • Criminal Justice Interventions • Innovation and System Transformation Strategic Plan (2024–2027) Goals The Commission’s current behavioral health strategic priorities include: • Elevating diverse community voices • Advocating for system-wide improvements • Leveraging national and global best practices • Building networks to improve access, outcomes, and equity • Driving innovation and continuous learning • Setting and upholding high expectations for system performance The Commission collaborates with the California Health and Human Services Agency and other state and local partners to evaluate outcomes, track progress, and ensure accountability in behavioral health reforms. Control Environment With the passage of Proposition 1, the Behavioral Health Services Act (BHSA), in March 2024, the Commission increased from 16 to 27 Commissioners. The full Commission currently meets at least five times per year. The Commissioners appointed a new Executive Director in May 2025. Together, the Executive Director, Chief Deputy Director of Administration and Performance Management, Deputy Director of Research, Evaluation, and Programs, Deputy Director of Legislative Affairs, and Chief Counsel make up the CBH’s Executive team. The Commission’s Executive Director is responsible for establishing and maintaining the CBH’s internal control and monitoring systems and, accordingly, has a strong commitment to ensure that the Commission’s executive leadership team has extensive knowledge of state agency and department procedures and reporting requirements. With this expertise, the Commission’s executive leadership team directs Commission staff to comply with the implementation of internal contracts and grant reviews to ensure the Commission is following State laws, appropriations, regulatory requirements, and legislative mandates. The State Leadership Accountability Act and California Government Code § 8546.4 require all agencies to conduct internal audits and undergo external audits by governing bodies, including the Department of Finance. Page 2 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 CBH is determined to create and sustain a positive and effective control environment. Through recruiting efforts, the Commission is committed to attracting competent individuals to assist in achieving the Commission’s priorities. The Commission strives to create and maintain a supportive work environment and encourages staff to attend training courses to promote professional growth as investments in staff helps to develop skills and subject matter expertise in order to maximize performance, which helps the Commission to develop and retain valuable employees. The Commission collects, utilizes and reports significant amounts of data and information to support its operations and ensure accountability and transparency. Data and information are gathered from a variety of sources, using various tools and systems. The Commission uses the data for program planning; policy development, implementation, and oversight; decision-making; budgeting, fiscal claiming and accounting; legislative reporting; and to support external research, among many other purposes. The Executive Director meets daily with the Executive Management team to discuss and strategically phase out BHSA mandates while also implementing the BHSA in strict adherence to the initiative requirements. The Executive Director also utilizes operational plans and holds bi-monthly meetings with Executive, middle- and front-line management teams to discuss updates on and implementation of strategic priorities. Furthermore, the middle-management team holds monthly in-person staff meetings to disseminate critical operational information and implement directions to staff from Commissioners. In addition to these activities, to advance operational effectiveness and/or eliminate inefficiencies, all CBH managers facilitate communication with CBH team members through activities that include, but are not limited to, monthly CBH All Team Meetings, direct emails (Microsoft Office/Outlook) and chat (Microsoft Teams), and verbal and written communications between CBH team members and their direct supervisors or managers. Core Business Functions To fulfill its mission, the Commission has five operational areas that execute the core business functions, as follows: • Administration and Performance Management • Legislative and External Affairs • Research, Evaluation, and Programs • Information Technology • Legal Information and Communication Page 3 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 The Commission’s Legislative and External Affairs team is dedicated to strengthening communication both internally and externally. This includes robust stakeholder engagement and outreach efforts involving the media, public advocacy groups, community-based organizations, the Legislature, the Administration, other governmental agencies and members of the public, providing regular updates on key policy and program initiatives to facilitate alignment and promote transparency. When implementing system improvements, the Commission collaborates with individuals, families, advocacy groups, service providers, counties, and other stakeholders - many of whom may hold differing or even conflicting perspectives. Through inclusive public forums and open dialogue, the Commission seeks to encourage broad participation and works to foster communication and problem-solving to drive effective, equitable change. Internal Communication and Monitoring Internally, the Commission prioritizes clear and consistent communication to support accountability and continuous improvement. Regular updates are shared within CBH’s management team to monitor project activities and deliverables, identify areas for improvement, and assess the effectiveness of current practices. The Commission also fosters a culture of openness, encouraging staff to confidently raise concerns or suggest improvements to their supervisors. This proactive approach supports the Commission’s mission and strengthens its ability to meet strategic goals. When risks or deficiencies are identified, such as upcoming deadlines or operational gaps, the appropriate teams are mobilized with the necessary support, and provide regular progress updates to CBH leadership to ensure deadlines are met in a timely manner. Communication Channels To ensure transparency and effective information-sharing, the Commission uses a variety of communication platforms: • Internal: SharePoint, ShareFile, staff meetings, senior and executive management meetings • External: Public website, social media, listening sessions, committee and Commission meetings, and public comment opportunities These channels help maintain open lines of communication, promote stakeholder trust, and support the Commission’s commitment to accountability and continuous quality improvement. Page 4 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 MONITORING The information included here discusses the entity-wide, continuous process to ensure internal control systems are working as intended. The role of the executive monitoring sponsor includes facilitating and verifying that the Behavioral Health Services Oversight and Accountability Commission monitoring practices are implemented and functioning. The responsibilities as the executive monitoring sponsor(s) have been given to: Lauren Quintero, Acting Deputy Director of Administration and Performance Management. The Commission is currently monitoring and overseeing the completion and sunsetting of the Mental Health Services Act (MHSA) initiatives and programs, as well as the transition to implement the programmatic mandates to meet BHSA requirements. The Commission utilizes its strategic and operational plans to ensure risks are mitigated. In addition, CBH management is provided with updates on vulnerabilities as they arise within various divisions. Vulnerabilities are weighted to determine level of risk and, if warranted, an action plan is adopted, disseminated, and implemented. RISK ASSESSMENT PROCESS The following personnel were involved in the Behavioral Health Services Oversight and Accountability Commission risk assessment process: executive management, middle management, front line management, and staff. The following methods were used to identify risks: brainstorming meetings, ongoing monitoring activities, audit/review results, other/prior risk assessments, and consideration of potential fraud. The following criteria were used to rank risks: potential impact to mission/goals/objectives, timing of potential event, potential impact of remediation efforts, and tolerance level for the type of risk. Page 5 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 RISKS AND CONTROLS Risk: Operational Effectiveness The transition from MHSA to BHSA, along with the need to sustain existing services while implementing new initiatives, has introduced increased complexity and shifting workload priorities. These shifting priorities may lead to operational disruptions, reducing the Commission’s ability to maintain full accountability and transparency. As a result, there is a risk of administrative and programmatic delays in implementing Proposition 1, potentially impeding the Commission’s ability to fulfill its intended purpose. Control: Organizational Structure for Internal Legal and Regulatory Interpretation The Commission’s teams were restructured to provide additional leadership to assist with the interpretation of laws and regulations. Control: Communication The Commission continues to monitor regulatory changes by conducting ongoing meetings and facilitating communication to ensure that the Commission stays informed about statutory and regulatory actions and/or varying interpretations of laws and regulations. Page 6 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 Risk: Small Workforce/Workforce Optimization The Commission is a relatively small organization, with fewer than 60 permanent employees. Like many state agencies, it has identified workforce optimization as a significant organizational risk. The principle of “working smarter, not harder” reflects the Commission’s commitment to maximizing efficiency, improving processes, and making the most of its limited resources. Control: Workforce Optimization Advisory Committee The Workforce Optimization Advisory Committee provides strategic guidance to the Commission on human resources matters, including oversight of the Executive Director’s performance, staff culture, and overall organizational effectiveness. The Committee serves as a key resource in supporting the Commission’s responsibilities related to human capital management, while ensuring alignment with applicable laws, regulations, and the Bagley-Keene Open Meeting Act. Risk: Contract and Grant Administration Given the significant level of funding administered by the Commission and the compressed timeframes for soliciting and awarding contracts and grants, there are inherent risks in contract and grant administration. These include challenges in ensuring timely execution, maintaining compliance, and effectively monitoring performance. Additionally, the volume and complexity of active grants make it difficult to consistently track deliverables, milestones, and outcomes. This can lead to delays, inefficiencies, or gaps in oversight, potentially impacting the Commission’s ability to meet its strategic goals and ensure accountability. Page 7 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 Control: Contract and Grants Management The Commission is seeking to acquire comprehensive contract and grant management software that supports the full lifecycle of grant administration - from solicitation and award, to grant execution and payment processing. This initiative is part of the Commission’s ongoing efforts to enhance process efficiency, improve functionality, and build staff expertise. Risk: Staff Recruitment and Retention: Person Dependence, Workforce Planning The implementation of the BHSA presents significant operational challenges for the Commission. These challenges are compounded by recent organizational changes, including the expansion of the Commission from 16 to 27 members and the retirement of several high-level staff. The Commission is currently facing difficulties in retaining and recruiting highly qualified personnel during this critical transition. Staff may have limited training or expertise in navigating the evolving legal and regulatory landscape, which can hinder their ability to effectively review, implement, or interpret programmatic requirements. The sunset of MHSA programs, along with the concurrent implementation of BHSA initiatives, has resulted in a dramatic workload increase. With a compact team, the Commission is at risk of being under-resourced to meet its programmatic and strategic objectives. The complexity of managing overlapping mandates, combined with lengthy hiring processes and ongoing workforce shortages, places additional strain on remaining staff. This increases the risk of: • Loss of institutional knowledge • Delays in program and policy implementation • Reduced capacity to identify and pursue strategic opportunities • Inefficiencies in grant and contract administration Page 8 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 • Incomplete or delayed fulfillment of BHSA deliverables Without adequate staffing and targeted training for specialized roles, the Commission may experience workflow disruptions, diminished oversight, and a temporary reduction in its ability to improve behavioral health systems and services across the state. Control: Updated Hiring Process The Commission is working to streamline its hiring process to expedite hiring and fill vacancies with qualified programmatic, research, grant and contract monitors, and internal audit staff. Limited-term staff positions were recently established to build teams to achieve compliance with deadlines for implementation of the BHSA mandates. Control: Training The Commission relies heavily on a small team of subject matter experts, with little formal backup structure in place to cover staff absences or turnover. Due to its compact size, the Commission faces significant constraints in allocating time and resources for cross-training and specialized staff development. The limited number of highly-specialized positions further complicate efforts to build redundancy or effectively train new staff. To address these challenges, the Commission is committed to expanding both internal and external training opportunities aimed at enhancing staff knowledge and skills. This includes: • Offering specialized training programs to support CBH staff professional development • Enhancing internal processes to promote cross-training and reduce the risk of institutional knowledge loss • Developing targeted training for Commissioners to better support their roles and responsibilities • Establishing new committees to inform and support Commissioners on Page 9 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 content-related matters for Commission meetings and committee assignments • Implementing a learning management software to track trainings and offering Individual Development Plans (IDPs) to team members to promote professional growth and development Risk: Data Security and Cybersecurity Like other government entities, the Commission is at risk of unauthorized access, data breaches, and loss or misuse of confidential information, including sensitive personal data protected under laws such as the Health Insurance Portability and Accountability Act (HIPAA) and the Family Educational Rights and Privacy Act (FERPA). This risk arises from evolving cybersecurity threats, particularly phishing attacks, and the need to comply with state-mandated security standards. Without robust security controls, trained personnel, and continuous monitoring, the Commission could face significant operational, legal, and reputational consequences due to compromised data systems. Control: Cybersecurity Threat Monitoring and Response The Commission continues to monitor cybersecurity threats to its data systems. The Commission annually collects confidential data/records on California residents, requiring sophisticated tools and highly trained information security staff to protect its data systems and secure technical operations. The Commission security staff monitor internal and external threats, manage mandated security compliance requirements, coordinate risk and security incident reports, and conduct security related investigations. Page 10 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 The Commission is subject to bi-annual information security assessments by the California Military Department and Information Security audits by California Department of Technology (CDT) to identify areas of improvement in information security controls, policies, and procedures. Robust security policies and continuous training are necessary to help employees actively support the security of department data, assets, and IT systems. These policies must comply with information and security policies, standards and procedures issued by the California State Information Security Office. Failure to implement these policies could result in a data breach. Phishing is the most common type of attacks within most networks potentially resulting in data breaches. The Commission staff receive annual security awareness training on how to identify these fraudulent communications. The Commission IT team performs monthly phishing campaigns to ensure that staff are following protocols to identify and report suspicious emails through Go Secure Inbox Detection and Response. Staff who open suspicious emails instead of reporting them to IT staff are notified and additional training is provided. The consequences of a successful phishing attack could be severe if confidential information including Health Insurance Portability and Accountability Act (HIPAA), and Family Educational Rights and Privacy Act (FERPA), is accessed, exposed, or stolen. The Commission’s Information Security Officer is responsible for developing and managing formal standards and practices for ensuring sensitive data is protected from loss, theft, corruption, and misuse. Control: Robust Security Policies The Commission has security policies in place which have been reviewed and will continue to evaluate the need for new policies as required by the Office of Information Security. All staff are required to complete the annual Security and Awareness Training by December 31st of each year. Page 11 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 The Commission has developed a Phishing Requirements Plan to comply with the State of California’s Department of Technology’s Statewide Information Management Manual (SIMM) 5325A Technology Recovery Plan requirements, which require State Agencies to follow certain procedures to conduct adequate and sanctioned phishing training. The Commission is in compliance with Federal Bureau of Investigations (FBI) Criminal Justice Information Services (CJIS) security standards which are comprised of 13 policy areas outlined by National Institute of Standards and Technology Special Publication (NIST) SP 800-53. These domains include Incident Response Auditing and Accountability, Access Control, Identification and Authentication, Configuration Management, etc. State Defined Security Parameter deficiencies will be identified and remediated through the audit and Independent Security Assessment (ISA) process. The Commission will complete the State-Defined Security Parameters Findings Report. The Commission will also conduct additional training for Data Loss Prevention (DLP) and incident response management and complete additional refinement of its security awareness training program and to implement more realistic phishing scenarios. Risk: Fiscal Instability Due to Volatile Funding and Budget Constraints The department faces heightened fiscal risk due to a combination of unstable and diminishing funding sources. A key concern is the volatility of BHSA revenues, which are subject to economic fluctuations and may not provide consistent support year over year. Additionally, the reduction of the state administrative cap under the BHSA from 5% to 3% significantly limits the flexibility of state-level oversight and operational funding. This constraint is compounded by the broader state budget deficit and anticipated federal funding cuts, both of which increase the likelihood of program reductions. These financial pressures pose a particular threat to grant-funded initiatives, including the Mental Health Wellness Act, Innovation Partnership Fund, Advocacy, and Behavioral Health Student Services Act, all of which are funded by the BHSA. Collectively, these Page 12 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 factors create an environment of fiscal uncertainty that could impact service delivery, staffing, and strategic priorities. Control: Strategic Fiscal Oversight and Prioritization Measures To address and mitigate these fiscal risks, the department has implemented a series of proactive controls. These include targeted efforts to reduce discretionary spending, such as limiting travel and streamlining operational costs. Oversight has been strengthened through the Commission’s Budget and Fiscal Analysis (BFA) Committee, which was recently established to play a critical role in monitoring CBH expenditures and ensuring alignment with strategic goals. Enhanced CBH grant management practices have also been adopted to maximize the efficiency and impact of available funding, including closer tracking of deliverables and timelines. Furthermore, the department is intentionally narrowing its focus by reducing the number of concurrent priorities, allowing for more concentrated resource allocation and minimizing the risk of overextension. These measures collectively aim to preserve program integrity and maintain fiscal stability in the face of external financial pressures. CONCLUSION The Behavioral Health Services Oversight and Accountability Commission strives to reduce the risks inherent in our work and accepts the responsibility to continuously improve by addressing newly recognized risks and revising risk mitigation strategies as appropriate. I certify our internal control and monitoring systems are adequate to identify and address current and potential risks facing the organization. Page 13 of 14 Behavioral Health Services Oversight and Accountability Commission 2025 Leadership Accountability Report December 24, 2025 Brenda Grealish, Executive Director CC: California Legislature [Senate, Assembly] California State Auditor California State Library California State Controller Director of California Department of Finance Secretary of California Government Operations Agency Page 14 of 14