Recommendations

The Child Abuse Central Index The Unreliability of This Database Puts Children at Risk and May Violate Individuals’ Rights May 2022 REPORT 2021‑112 IMAGE PENDING CALIFORNIA STATE AUDITOR 621 Capitol Mall, Suite 1200 | Sacramento | CA | 95814 916.445.0255 | TTY 916.445.0033 For complaints of state employee misconduct, contact us through the Whistleblower Hotline: 1.800.952.5665 Don’t want to miss any of our reports? Subscribe to our email list at auditor.ca.gov For questions regarding the contents of this report, please contact our Public Affairs Office at 916.445.0255 This report is also available online at www.auditor.ca.gov | Alternative format reports available upon request | Permission is granted to reproduce reports Michael S. Tilden Acting State Auditor May 31, 2022 2021-112 The Governor of California President pro Tempore of the Senate Speaker of the Assembly State Capitol Sacramento, California 95814 Dear Governor and Legislative Leaders: Our audit of the California Department of Justice’s (DOJ) Child Abuse Central Index (CACI)—the database that is meant to be a comprehensive list of individuals with substantiated reports of child abuse—found that less than half of the 52,000 reports of child abuse that social workers substantiated from July 2017 through June 2021 were in CACI. This difference means that authorized users of CACI cannot depend on the database to help protect children when they make decisions about hiring individuals to work in day care centers or group homes, or about whom they can entrust with the care or custody of a child. The audit found that the current child abuse reporting process is cumbersome and error-prone, and it revealed multiple reasons for CACI’s incomplete data. Specifically, DOJ did not always enter into CACI the reports of child abuse it received from counties, and counties did not always send reports of child abuse to DOJ for entry into the database. Furthermore, state law allows for differing interpretations of which child abuse reports the counties should send to DOJ. As a result, at least one county requires that a social worker interview a suspected child abuser before it will submit a substantiated report of child abuse to DOJ, while other counties do not generally follow this interpretation. To better protect children from individuals with a history of perpetrating abuse, the Legislature should streamline the process for sharing reports of child abuse, which would help DOJ provide the most complete and accurate response to the background checks authorized users request. Respectfully submitted, MICHAEL S. TILDEN, CPA Acting California State Auditor 621 Capitol Mall, Suite 1200 | Sacramento, CA 95814 | 916.445.0255 | 916.327.0019 fax | www.auditor.ca.gov iv California State Auditor Report 2021-112 May 2022 Selected Abbreviations Used in This Report ACHS California Automated Criminal History System CACI Child Abuse Central Index CWS Child Welfare Services CWS/CMS CWS Case Management System DOJ California Department of Justice California State Auditor Report 2021-112 v May 2022 Contents Summary 1 Recommendations 3 Introduction 7 Audit Results CACI Is Missing Many Suspects With a History of Child Abuse 13 DOJ and County CWS Agencies Could Not Adequately Explain Why CACI Is Missing Thousands of Substantiated Reports of Child Abuse 15 CACI Incorrectly Identifies Some Individuals as Having a History of Child Abuse 20 DOJ Lacks Adequate Controls for Ensuring That CACI Contains Accurate and Appropriate Records 22 Legislative Action Is Needed to Fix the State’s Error-Prone and Inefficient Process for Entering Data Into CACI 23 Appendix A Statewide Statistical Information in CACI 29 Appendix B Scope and Methodology 39 Response to the Audit Calaveras County 43 California Department of Justice 45 California State Auditor’s Comments on the Response From the California Department of Justice 55 California Department of Social Services 59 California State Auditor’s Comments on the Response From the California Department of Social Services 65 Contra Costa County 69 Kern County 71 California State Auditor’s Comments on the Response From Kern County 75 vi California State Auditor Report 2021-112 May 2022 Orange County 77 California State Auditor’s Comment on the Response From Orange County 79 Shasta County 81 Stanislaus County 83 California State Auditor Report 2021-112 1 May 2022 Summary Results in Brief Audit Highlights . . . The California Department of Justice (DOJ) administers the Child Our audit of CACI highlighted the following: Abuse Central Index (CACI), a database containing substantiated » Although CACI is meant to be a cases of physical, sexual, and emotional abuse or severe neglect of comprehensive database of substantiated a child (child abuse) that have been forwarded to DOJ by county cases of child abuse identified by county Child Welfare Services (CWS) agencies. Authorized users, such CWS agencies throughout the State, we as social welfare, law enforcement, and county licensing agencies, found that it does not contain records rely on information in CACI to inform screening decisions for for as many as 22,000 individuals with applicants who wish to care for children or before placing a histories of substantiated child abuse child in a foster care home, among other reasons. However, the during a recent four-year period. effectiveness of CACI as a tool for protecting children is seriously hindered by inaccurate and incomplete data. • Users of this database cannot depend on it to help protect children from Specifically, we found that CACI does not contain more than being placed in the care of individuals half of the child abuse cases, or about 27,000 cases, that were with a history of abusing children. substantiated by county CWS agencies statewide during the • In fact, we found that DOJ provided four-year period ending in June 2021, equating to 22,000 unique at least 224 letters to authorized suspects with a history of child abuse being completely excluded users indicating that individuals from the database. Moreover, given the significant gap in CACI did not have substantiated child reports for the four-year period we reviewed, it is highly likely abuse reports when county records that CACI is also missing a large number of suspects from prior indicated otherwise. years that we did not examine. Our review of a selection of 60 cases that were not in CACI from six counties—Calaveras, » Conversely, but on a smaller scale, CACI Contra Costa, Kern, Orange, Shasta, and Stanislaus—revealed that incorrectly identifies some individuals miscommunication among county staff and a lack of tracking from as having a substantiated history of DOJ were major causes of these missing reports. We further found child abuse. that state law and certain counties’ processes allow county staff to substantiate certain cases but not report them to CACI when the • We found 298 reports of child abuse social worker is unable to interview the suspected abuser. Because in CACI that were not supported by of this nuance in state law, some substantiated cases of child sexual county records. abuse and exploitation are not being reported to CACI. As a result, » The State relies on an error-prone manual the safety of children is at risk because authorized users of CACI process for managing CACI data. are unable to appropriately vet individuals before enabling them to have access to children. In fact, when we compared the list of » We recommend legislative action to substantiated reports of child abuse that are not in CACI with reduce errors and inefficiencies in the individuals about whom DOJ performed CACI background checks, child abuse background check process by we found that DOJ provided at least 224 letters to authorized users, giving DOJ direct access to substantiated such as county licensing agencies, indicating that these individuals child abuse reports contained in the same did not have substantiated child abuse reports in CACI when system counties use to record the results county records indicated otherwise.1 of their child abuse investigations. 1 As indicated in the Audit Results, available evidence indicates that DOJ sent but did not retain additional letters to authorized users that had requested expedited background checks for individuals whose substantiated cases of child abuse are not in CACI. However, we cannot accurately determine the number of additional letters that DOJ sent. 2 California State Auditor Report 2021-112 May 2022 Additionally, although the problem is not nearly the same size or scope as the thousands of missing records in CACI, we identified 298 reports of child abuse in CACI during the same four-year period that did not have corresponding substantiated reports of child abuse in county records. Because these individuals were included in CACI, DOJ sent at least 25 letters in response to background checks by authorized users notifying them that these individuals were a possible match with a known child abuse suspect in CACI. These records were included in CACI because of a number of factors, including county CWS agencies’ and DOJ’s lack of appropriate policies for removing records from CACI. As a result, DOJ indicated that these individuals had a history of child abuse, which could result in authorized users denying or delaying the opportunity for these individuals to care for children. The source of many of the problems we found is the State’s reliance on an inefficient, manual process for managing CACI data, a process that is prone to avoidable errors. As a result, DOJ was unable to ensure that it had entered all reports into CACI, and we determined that 22,000 suspects with a substantiated history of child abuse were not included in CACI. DOJ was also unable to demonstrate that it has appropriately deleted records from CACI. These problems can hinder DOJ from quickly and reliably responding to CACI background checks, and they further increase the risk that DOJ would send a response letter with incomplete or inaccurate information. However, the Legislature could resolve this by changing state law to give DOJ direct access to the same system that county CWS agencies use to document county-substantiated cases, bypassing the cumbersome and error-prone CACI reporting process and thereby increasing the accuracy and efficiency of the background checks DOJ performs on individuals wishing to care for children. Agency Comments Although DOJ believed it needed to provide additional context related to our audit findings and conclusions, it generally agreed to implement our recommendations. Social Services generally agreed with the intent of our recommendations, but expressed concerns with how it would implement the recommendations. The counties we reviewed generally agreed with our findings and conclusions and indicated that they would implement our recommendations. California State Auditor Report 2021-112 3 May 2022 Recommendations The following are the recommendations we made as a result of our audit. Complete descriptions of the findings and conclusions that led to these recommendations can be found in the Audit Results section of this report. Legislature To better protect children when an authorized user requests a child abuse background check, the Legislature should amend state law to require DOJ to directly access and review CWS Case Management System (CWS/CMS) data, which counties already use to record the results of their child abuse investigations. If the Legislature implements this change, it should no longer require counties to submit reports of child abuse to DOJ for inclusion in CACI, thus eliminating redundant efforts and reducing the risk of error. To maximize the effectiveness of child abuse background checks in protecting children, the Legislature should amend state law to require all reports of substantiated child abuse to be included in DOJ’s background checks. To protect the due process rights of individuals, the Legislature should continue to require a grievance hearing process. DOJ Until the Legislature amends state law and DOJ develops processes to use the CWS/CMS data for child abuse background checks, DOJ should do the following: • Immediately develop a process for responding to child abuse background checks that includes checking CACI and the list of 298 reports of child abuse that were not supported by county records, and working with the California Department of Social Services (Social Services) to check the list of 27,000 reports of substantiated child abuse that were not contained in CACI. If the individual is on either list, DOJ should follow up with the relevant county to determine whether the individual’s report should be included in CACI. • Collaborate with Social Services by November 2022 to identify and reconcile all reports that should have been submitted to CACI by counties. Work with counties to enter all missing reports into CACI by June 2023. This collaboration should not be limited to the reports in our four-year audit period. 4 California State Auditor Report 2021-112 May 2022 • To ensure that it accurately enters all cases of child abuse it receives, by July 2022 DOJ should develop policies and procedures to track, enter into CACI, and review data entry for all reports of child abuse it receives from counties. Also by July 2022, DOJ should develop policies and procedures to track those reports that it sends back to counties for correction. • To ensure that only appropriate records are removed from CACI, by July 2022 DOJ should develop policies and procedures related to how staff remove records from CACI. These policies and procedures should include a process to verify that deletions are appropriate. • To prevent omissions in CACI reporting, DOJ should develop policies and procedures by November 2022 to reconcile CACI with monthly reports from Social Services to verify that counties have submitted—and DOJ has entered or deleted as appropriate—all reports into CACI. To ensure that authorized users have accurate and complete information, by July 2022 DOJ should send revised letters for the suspects whose reports of child abuse were omitted from CACI and for individuals inappropriately included in CACI. To ensure that it is able to revise expedited letters if they are later determined to be incorrect, DOJ should immediately begin maintaining a history of all responses to expedited background checks. To ensure that suspects’ information is deleted from CACI in accordance with state law, by November 2022 DOJ should research and address the 36,000 reports in CACI lacking birth dates by entering the suspect’s correct birth date and removing suspects who no longer meet the CACI requirements. Social Services Until the Legislature amends state law and DOJ develops processes to use CWS/CMS, Social Services should do the following: • Immediately develop a process to collaborate with DOJ and counties to review the list of 27,000 reports of substantiated child abuse that were not in CACI and ensure that all eligible missing reports are forwarded to DOJ. • By November 2022, develop monthly reports from CWS/CMS of cases of child abuse substantiated during the month and another list of cases that changed from substantiated to not substantiated, and then provide these reports to the counties and to DOJ. California State Auditor Report 2021-112 5 May 2022 • By November 2022, ensure that all counties develop policies and procedures to review the monthly reports produced by Social Services and ensure that they have sent all appropriate reports to DOJ. • By November 2022, collaborate with DOJ to identify and reconcile all reports that should have been submitted to CACI by counties and work with counties to send all reports to CACI by May 2023. This collaboration should not be limited to the reports of our four-year audit period. Counties To ensure that it submits accurate and complete information to CACI, by July 2022 Calaveras County should develop policies and procedures for reporting all incidents of substantiated child abuse that it actively investigates, in accordance with state law. To ensure that they correctly revise and resend reports that were incomplete and needed correction, by July 2022 Calaveras, Kern, Orange, Shasta, and Stanislaus counties should develop policies and procedures for accurately responding to and tracking reports DOJ sends back for correction. To ensure that CACI contains accurate and complete information, and to ensure that individuals’ rights are adequately protected, by July 2022 Calaveras, Contra Costa, and Shasta counties should develop policies for removing existing reports in CACI when warranted. To ensure that CWS/CMS contains accurate investigation conclusions, by July 2022 Calaveras and Contra Costa counties should immediately identify and correct the reports in CWS/CMS that are incorrectly marked as substantiated. To ensure fair and impartial grievance hearings and to comply with state regulations, Contra Costa, Kern, and Stanislaus counties should, by July 2022 adopt grievance hearing policies allowing the complainant to challenge the impartiality of the grievance review officer. To ensure the confidentiality of sensitive and personally identifying information protected by state law, Orange and Stanislaus counties should, by July 2022 adopt grievance hearing policies requiring the return of confidential evidence when the county provides such evidence to suspects for a grievance hearing. 6 California State Auditor Report 2021-112 May 2022 Blank page inserted for reproduction purposes only. California State Auditor Report 2021-112 7 May 2022 Introduction Background Since 1965 state law has required the California Department of Justice (DOJ) to maintain the Authorized Users of CACI Child Abuse Central Index (CACI) as a statewide For the purpose of investigating or prosecuting child repository for reports of child abuse and severe abuse, or for performing background checks on individuals neglect. County Child Welfare Services (CWS) who will care for or have regular contact with children, agencies submit substantiated reports to DOJ state law authorizes the following entities to have access after determining through their investigations to CACI records: that it is more likely than not that an individual • California Department of Social Services has intentionally caused a child physical harm or death, has committed sexual assault or exploitation • County licensing agencies of a child, or has intentionally failed to provide • Tribal agencies food, clothing, shelter, or medical care to a child.2 • In-state or out-of-state adoption agencies Throughout this report we refer to these various acts of abuse and severe neglect as child abuse. • Health care practitioners who are treating individuals State law restricts the release of information in reported as possible victims of child abuse CACI to authorized users, listed in the text box, • State or county child death review councils and to individuals requesting information on whether they are listed in CACI. • Law enforcement agencies • County welfare departments The primary purpose of CACI is to centralize • Prosecutors and court investigators reports of child abuse so that authorized users can locate reports about individuals and identify • Court Appointed Special Advocates the local agency that investigated the incident. • Government agencies conducting background As of August 2021, CACI contained references to checks for peace officer applicants. more than 700,000 reports of child abuse. This • Other county child welfare agencies or their information enables authorized users conducting delegates who conduct background investigations on background checks to determine whether an applicants seeking employment or volunteer status individual has been named as a suspect of that would give them direct access to children. substantiated allegations of child abuse, and, if so, to obtain the investigative information in order Source: State law. to inform decisions when hiring staff to care for children or when placing children under someone’s care. For example, state law requires licensed adoption agencies to check CACI—in addition to performing a criminal record review—as part of their vetting process of any prospective adoptive parent. Should DOJ notify the authorized user that CACI contains a relevant report, state law requires the authorized user to obtain the original investigation report and to form an independent hiring or placement decision based on the quality of the evidence in the report. 2 Prior to 2012, local law enforcement agencies also sent child abuse reports to DOJ. 8 California State Auditor Report 2021-112 May 2022 The Importance of CACI Although state law may require authorized users to perform criminal history reviews, including a check of criminal information databases, these databases do not necessarily contain the same individuals or information that CACI does. Notably, the California Automated Criminal History System (ACHS) records information such as arrests or convictions, which require different evidentiary standards than is required for inclusion in CACI. For example, for a suspect to be found guilty of a criminal charge of child abuse in a court proceeding—and have the conviction entered into ACHS—a court would have found, beyond a reasonable doubt, that the child abuse occurred. On the other hand, CACI contains substantiated reports of child abuse, which state law defines as those cases in which the investigator concluded that child abuse more likely than not occurred, which is a lower evidentiary standard. Further, state law prohibits the release of arrest or court information from ACHS under certain circumstances, such as when the individual completes education, treatment, or rehabilitation programs in lieu of further criminal proceedings. In these cases, DOJ would report that ACHS did not contain any criminal history of the individual, and the only record of a substantiated investigation of child abuse would come from CACI. Because some authorized users have access to certain reports of child abuse only through CACI, it is critical that CACI be accurate and complete. State law describes counties as responsible for the completeness and accuracy of the reports they send to DOJ, and it also requires DOJ to maintain the database and ensure that the information counties submit is accurately reflected in CACI. If suspect reports are not added to CACI as state law requires, authorized users may lack critical information when deciding whether to allow an individual to have contact with children. Additionally, to the extent that authorized users do not perform independent reviews of CACI information sent to them by DOJ, individuals who are incorrectly included in CACI may be denied certain rights and privileges, such as the ability to adopt children or the ability to be employed to care for children. Information Flow of CACI Reports County social workers conduct investigations of suspected child abuse and document these investigations in the statewide CWS Case Management System (CWS/CMS) maintained by the California Department of Social Services (Social Services). In addition to recording information on the allegations of abuse and the individuals involved, CWS/CMS contains a variety of information such as records of foster placements of children, California State Auditor Report 2021-112 9 May 2022 services provided to families, and relevant actions by the courts. When social workers complete the associated investigations and substantiate allegations, CWS/CMS automatically populates a CACI report with the available data. Social workers then print, finalize, and mail the reports to DOJ as DOJ requires. According to DOJ, if it determines that the reports are missing any required information, it mails the reports back to the county and requires the county to resend corrected reports. DOJ’s staff manually enter complete reports into the CACI database. Then, a DOJ staff member reviews the data entry to ensure that it accurately reflects the reports before a separate DOJ unit scans and stores an electronic copy of the reports. Figure 1 shows the CACI report submission, input, and reporting processes. When counties need to amend or remove an existing report from CACI, they may mail, fax, or State law requires DOJ to remove suspect records from CACI for the following reasons: email DOJ a request to do so. According to DOJ, it reviews these requests and either updates the • The suspect reaches 100 years of age. information in CACI or deletes the record. State law requires DOJ to remove suspect records from • The suspect was under 18 years of age at the time of the incident, is listed once in CACI with no subsequent listings, CACI for the reasons described in the text box. and 10 years have passed since the date of the incident. Finally, DOJ staff process the requests from • The reporting agency notifies DOJ that the suspect should authorized users to search for individuals in be removed from CACI because the original report is no CACI. According to DOJ, its staff search for longer substantiated. possible matches between suspects in CACI and Source: State law. the individual’s identifying information provided during the application process. Depending on the result of the CACI search, DOJ responds to the authorized user with a letter stating that either there was no match to CACI suspects or there was a possible match to CACI suspects. The possible match letter advises the authorized user to contact the county CWS agency that submitted the report for further information.3 3 DOJ indicated that it sends a notification to the suspect when there is a possible match to CACI records and when the purpose of the background check does not involve caring for a relative’s child. We did not validate whether DOJ consistently performs this notification to the suspect because we found no requirement that it do so. 10 California State Auditor Report 2021-112 May 2022 Figure 1 Information Flow for Reports of Child Abuse COUNTY CHILD WELFARE SERVICES AGENCIES SUBSTANTIATE CASES OF CHILD ABUSE County social worker Social worker enters County staff print the Supervisor reviews the investigates and the investigation into report of the incident. report and makes substantiates an CWS/CMS. changes, if necessary. incident of child abuse. County mails County staff perform additional the report work to revise the report. to DOJ. US Postal Service delivers the report back to US Postal Service delivers the the county child welfare services agency. report to DOJ in Sacramento. DOJ ENTERS INFORMATION INTO CACI DOJ mails the report back to the county to fill Missing information in missing information. DOJ evaluates whether the report is DOJ sorts and bundles mail for the Complete complete or missing information. unit that processes CACI reports. DOJ manually enters DOJ reviews the the report into CACI. data entry work. BACKGROUND CHECK DOJ RESPONDS TO BACKGROUND CHECKS ? Authorized user requests a background DOJ searches for the individual in DOJ prints and mails a check, including a CACI search. CACI and generates either a “no match” response letter to the or a “possible match” letter. background check requester. Source: State regulations, county policies, and interviews with staff at DOJ and Calaveras, Contra Costa, Kern, Orange, Shasta, and Stanislaus counties. California State Auditor Report 2021-112 11 May 2022 Grievance Hearings Process According to state law, when counties submit a CACI report to DOJ, they must notify the suspect that a report of the substantiated child abuse, listing the individual as the suspected perpetrator, has been added to CACI and that he or she has a right to request a grievance hearing to challenge inclusion in CACI. Social Services’ regulations allow a county to conduct an internal review of the matter identified in the request before holding a hearing. State law and regulations also impose various protections for ensuring the fairness of grievance hearings, such as requiring the exchange of evidence between the county and the suspect in advance and requiring a process that enables the suspect to challenge the impartiality of the hearing’s presiding officer, whom the county can select. Moreover, when a hearing concludes that the suspect’s CACI listing was based on a report that was not or is no longer substantiated, state law requires county CWS agencies to notify DOJ of the result, and it requires DOJ to remove that person’s name from CACI. According to DOJ, it processes written requests from counties to remove records for individuals, and when it finds the corresponding individual and report to remove from CACI, it deletes the individual’s report from the system. If DOJ also determines that it sent a possible match letter to a CACI authorized user within the past 12 months, it sends an amended letter to notify the authorized user of the change in status. CACI Reporting Is a State‑Mandated Program In 2007 the Commission on State Mandates found that certain requirements imposed on county CWS agencies, including CACI reporting requirements, constitute a state mandate. As such, county CWS agencies can opt out of this reporting unless they receive funding from the State. To provide resources for counties to continue child abuse reporting, recent budget acts have allocated funding to the counties in the form of Interagency Child Abuse and Neglect block grants. The vast majority of counties accepted this grant funding and therefore remained obligated to submit CACI reports to DOJ. Although at least one county voluntarily continued to report child abuse to DOJ, four counties opted out of this grant for some portion of our four-year audit period and thus were not required to complete the CACI reporting in those years that they opted out. We estimate that these four counties were not obligated to report only about 200 cases of substantiated child abuse, or 0.4 percent of all substantiated child abuse in the State during the four-year period we reviewed. Therefore, this particular condition had little to no effect on the analysis presented in our Audit Results. 12 California State Auditor Report 2021-112 May 2022 Blank page inserted for reproduction purposes only. California State Auditor Report 2021-112 13 May 2022 Audit Results CACI Is Missing Many Suspects With a History of Child Abuse CACI does not contain all of the reports of child abuse contained in the county CWS agencies records. In evaluating CWS/CMS data statewide, we identified more than 52,000 reports of substantiated child abuse that the counties generated during the four-year period ending June 2021. However, as shown in Figure 2, CACI contained only about 25,000 of these substantiated reports, meaning that it did not include more than half—about 27,000. These 27,000 reports concern about 25,000 unique suspects, and more than 22,000 of these suspects had no other reported information in CACI. As a result, authorized users requesting background checks for these 22,000 individuals may be unaware that these individuals have a history of substantiated child abuse. Given this significant gap in CACI reports for the four-year period we reviewed, it is highly likely that CACI is also missing a large number of suspects from other years that we did not examine. Figure 2 CACI Does Not Contain 22,000 Suspects Because It Is Missing Substantiated Reports of Child Abuse for the Period of July 2017 Through June 2021 As a result, 22,000 unique suspects are completely missing from CACI. CWS/CMS 48 52 % % contains more than 52,000 reports. CACI contains more than Nearly 27,000 reports 25,000 reports that are appear in CWS/CMS but supported by county records. do not appear in CACI. Source: Data from DOJ and Social Services. 14 California State Auditor Report 2021-112 May 2022 Children are at risk of being harmed when CACI is incomplete because the missing data may result in an authorized user permitting a suspect to have access to children. As we discuss in the Introduction, CACI enables authorized users conducting background checks to determine whether an individual has a history of substantiated child abuse. However, if CACI is incomplete, DOJ cannot notify an authorized user of a missing suspect’s abuse record. If the authorized user then permits the suspect to have access to children, those children are at increased risk of abuse. We compared the list of the approximately 27,000 substantiated reports of child abuse that were not in CACI with the individuals for whom DOJ performed a requested CACI check as of August 2021. As a result of our analysis, we found at least 224 instances in which DOJ sent a letter to an authorized user indicating that an individual did not match with any report in CACI even though we determined that each of those individuals had at least one substantiated case of child abuse in CWS/CMS. These authorized users might have unknowingly made children more vulnerable to abuse by enabling these suspects to have access to children. For example, in September 2020, an authorized user inquired about an individual who was requesting a license for a family day care. This individual had a history of substantiated child abuse in CWS/CMS, yet because CACI did not contain this report, DOJ sent the authorized user a letter stating that the individual did not match any reports in CACI. As a result of our inquiry, DOJ worked with the county to obtain the report, and in March 2022 DOJ notified the authorized user of the child abuse. However, during the intervening 18 months, the individual may have inappropriately had access to children. Available evidence suggests that Additionally, available evidence suggests that the total number of the total number of letters DOJ letters DOJ sent to authorized users indicating that individuals sent to authorized users indicating did not match to CACI even though they had a substantiated that individuals did not match case of child abuse is much higher than the 224 letters we found. to CACI even though they had a These additional letters would have resulted from DOJ’s expedited substantiated case of child abuse CACI background check process. For such expedited background is much higher than the 224 letters checks, DOJ only maintains up to two months of request data we found. and does not retain copies of all of the resulting letters. For the data available at the time of our review, we found an additional 97 expedited requests for individuals with a history of child abuse whose reports were not in CACI. Although DOJ did not maintain letters resulting from all of these requests, these letters would not have been able to disclose the substantiated cases of child abuse missing from CACI. Therefore, authorized users could not have obtained and used these case records in their efforts to vet or investigate these individuals. Although we cannot quantify the number of expedited letters in which authorized users would California State Auditor Report 2021-112 15 May 2022 not have been notified of substantiated cases of child abuse, we The current incompleteness of CACI believe the current incompleteness of CACI greatly diminishes the greatly diminishes the reliability of reliability of DOJ’s expedited CACI background check process and DOJ’s expedited CACI background poses a significant threat to the safety of children. check process and poses a significant threat to the safety of children. DOJ and County CWS Agencies Could Not Adequately Explain Why CACI Is Missing Thousands of Substantiated Reports of Child Abuse We followed up on 60 selected reports of child abuse at the six counties we reviewed, out of the approximately 27,000 substantiated child abuse reports statewide that were not in CACI, to determine whether the reports met the CACI reporting requirements and why they were not included in CACI. For the majority of missing reports, DOJ and the county CWS agencies could not adequately explain why the reports are missing from CACI. Overall, the counties appear to have provided 29 of the 60 reports to DOJ, as shown in the Table, but we were unable to find them in CACI. For another 23 reports, the counties either did not mail the reports to DOJ or the counties could not demonstrate that they had done so. For five reports, the counties incorrectly recorded the cases as substantiated and appropriately did not send the reports to DOJ. Finally, for the remaining three reports, the county asserted that the reports did not meet CACI reporting requirements despite substantiating the allegations of child abuse against these suspects. Our review confirmed that 52 of the 60 reports should have been entered into CACI. The failures in communication and data entry throughout the reporting process are extremely concerning because these reports that should have been added to CACI represent suspects about which those who depend on CACI would not be informed. 16 California State Auditor Report 2021-112 May 2022 Table Counties Failed to Send and DOJ Failed to Enter Reports of Substantiated Child Abuse NUMBER OF REPORTS Reports counties assert The county maintained a copy of the report in its 14* they sent to DOJ case files. The county maintained a copy of the report in its case files, but the report lacks some information that 15 DOJ requires. Subtotal 29 Reports counties did The county failed to send the report to DOJ. 14 not send to DOJ or The county did not maintain a copy of the report in could not demonstrate its case files but has other evidence it may have sent 9 they had done so the report. Subtotal 23 Reports for which the The county should not have recorded the incident as county incorrectly substantiated child abuse in CWS/CMS. The county 5 recorded the outcome appropriately did not send a report to DOJ. of the investigation Reports the county The county substantiated child abuse, but it determined substantiated but that that its investigations and conclusions did not meet 3 should not be sent CACI reporting requirements. to DOJ Total 60 Source: Analysis of DOJ and Social Services data and county documents. * DOJ entered one of these reports after we received a copy of the CACI data in August 2021. DOJ Could Not Adequately Explain Why It Failed to Enter Reports Into CACI DOJ could not explain why it failed to enter reports into CACI because it did not track the reports it received. It also lacked policies for its process of entering information into CACI. When we discussed with DOJ the 29 reports that counties appeared to have submitted but that were not in CACI, the manager of the applicant services program over CACI background checks (applicant services manager) was not able to verify that DOJ had received all of those reports. Specifically, although the applicant services manager stated that DOJ entered one report into CACI after we obtained data for our analysis, she was unable to verify that DOJ received the other 28 reports because DOJ did not adequately track the CACI reports it received. When we showed the applicant services manager the 28 reports, she indicated that some of the reports lacked key information, such as the date of the incident, and DOJ likely would have returned these reports to the county for correction. When we California State Auditor Report 2021-112 17 May 2022 reviewed the reports, we confirmed that 15 reports were missing information DOJ had previously asserted was required. However, DOJ did not track reports that it sent back to counties. For the remaining 13 reports, the applicant services manager was not able to locate the reports and stated that DOJ might not have received them. As of April 2022, DOJ asserts that it has implemented procedures to better track reports it receives from counties. Nevertheless, because DOJ did not track the reports it received from counties or the reports it sent back to them, it was unable to verify why these reports are missing from CACI. Further, while Contra Costa County has policies and procedures for correcting child abuse reports that DOJ returns to it, the remaining five counties we reviewed—Calaveras, Kern, Orange, Shasta, and Stanislaus—lack such policies. Thus, even if DOJ returned reports to these counties for correction, they may not have adequately addressed DOJ’s concerns and sent updated reports for DOJ to add to CACI. Because of the lack of adequate policies and procedures at DOJ and some counties, many individuals have not been added to CACI, which limits its usefulness as an investigatory tool and the ability of authorized users of the database to protect children. The Six Counties We Reviewed Did Not Always Send Reports to DOJ For 23 of the 60 cases we reviewed, the counties did not send For 23 of the 60 cases we reviewed, CACI reports to DOJ or asserted that they sent the reports but the counties did not send CACI were unable to demonstrate that they had done so. Specifically, the reports to DOJ or asserted that they counties failed to submit 14 reports of substantiated allegations of sent the reports but were unable to child abuse to DOJ but were not always able to adequately explain demonstrate that they had done so. why their staff did not do so. For two cases, a manager at Orange County stated that supervisors had changed the investigation disposition to substantiated but failed to inform the staff who were responsible for sending the reports to DOJ. In addition, a manager at Stanislaus County told us staff incorrectly identified the suspect in two reports sent to DOJ. The counties failed to submit another 10 reports that met the reporting requirements to DOJ. Therefore, individuals who should be in CACI were not added, diminishing its usefulness for protecting children. For the nine remaining reports, the counties provided some evidence that they may have sent the reports to DOJ, but they did not maintain copies of the reports in their files, as their policies require. As a result, they could not confirm that they had sent these reports. Nevertheless, none of the reports were in CACI, which means authorized users could be uninformed about these suspects’ past child abuse. 18 California State Auditor Report 2021-112 May 2022 In addition to the 23 cases counties failed to send to DOJ, Calaveras and Contra Costa counties incorrectly recorded the outcomes of their investigations for five cases, but appropriately did not send CACI reports to DOJ. Specifically, Calaveras County acknowledged that it had previously instructed staff to categorize as child abuse certain cases in the CWS/CMS system in which newborns were exposed to controlled substances at birth because of their mother’s substance abuse but not to report such cases to CACI. However, according to state law, a newborn’s substance exposure is not in and of itself a sufficient basis for a report of child abuse. As a result of our inquiry into three of As a result of our inquiry into three of these cases, the county these cases, the county determined determined that it should have instead categorized these cases that it should have instead as general neglect, which is not reported to DOJ for inclusion in categorized these cases as general CACI. Contra Costa County also inappropriately recorded two neglect, which is not reported to DOJ reports as substantiated allegations of child abuse in CWS/CMS. for inclusion in CACI. In response to our inquiry, the county indicated that the incidents should not have been marked substantiated in CWS/CMS because the allegations were not substantiated following further review, in one case by county management and in the other case by a juvenile court. Even though CACI does not contain reports of child abuse for these cases, because the county incorrectly left the allegations marked as substantiated in CWS/CMS, the county inaccurately maintained negative information about the individuals in their investigation files. State Law Allows Certain Substantiated Cases of Child Abuse to Not Be Included in CACI Finally, for the last three cases, Kern County practices provide for it to not report these substantiated cases of child abuse to CACI in accordance with state law. Kern County explained that it did not submit these reports to CACI because social workers were unable to interview the suspects, which it considers a necessary part of the investigation. For example, in one case, law enforcement was investigating the suspect for human trafficking of a minor. Although county staff were unable to speak with the suspect, due to the preponderance of evidence, they substantiated the allegations of exploitation and closed their investigation. However, because county staff did not interview the suspect, Kern County did not report the suspect to CACI. As a result of this practice, although the suspects in each of the three cases had substantiated allegations of child abuse, including sexual abuse and exploitation, Kern County did not submit the reports to CACI. State law requires counties to report to DOJ all known allegations of child abuse for which the county has conducted an investigation and determined that the allegation is substantiated. At the same time, state law prohibits counties from sending a report to DOJ California State Auditor Report 2021-112 19 May 2022 unless it has conducted an active investigation and determined that the allegation is substantiated. Social Services’ guidance to counties defines active investigations as including, among many other items, interviews with the suspect and victim when appropriate and if they are available. This guidance directs counties to determine whether they have completed an active investigation on a case-by-case basis in coordination with the county legal counsel. However, the guidance states that, if a county substantiates an allegation relying on the results of a law enforcement or other investigation without conducting the county’s own active investigation, the county may choose to substantiate the allegation but should not refer the suspect to CACI. According to the program director of emergency response, Kern County requires staff to conduct an interview with the suspect in order to complete an active investigation. If staff members cannot interview the suspect, they may still substantiate the allegation of child abuse but will not submit a report to DOJ. Because county staff did not conduct suspect interviews for these three cases, Kern County substantiated that the suspects committed child abuse, but it did not submit the associated reports to DOJ. Although Kern County’s approach is allowed by state law and Social Services’ guidance, the other five counties we reviewed typically wait for law enforcement to finish its investigation before the county concludes its investigation or reaches a conclusion based on the available evidence and then reports the suspect to CACI if it substantiates an allegation of child abuse. For example, Calaveras County indicates that staff will request that law enforcement conclude its investigation, but if necessary, staff may decide to substantiate allegations without the suspect interview, based on other evidence and with the agreement of county counsel, and then report the suspect to DOJ. However, Orange County told us that staff will typically delay closing a case until a law enforcement investigation is completed, but staff usually cooperate with law enforcement, so it is rare that a social worker cannot interview the perpetrator and has to close the case without the interview. Because counties can substantiate certain allegations of child abuse and not report the suspects to CACI, which state law currently permits, CACI’s effectiveness in protecting children is limited. When a county substantiates an allegation of child abuse, the State law is limiting CACI’s county has determined that it is more likely than not that the child effectiveness in protecting abuse occurred. However, authorized users may be unaware of this children and authorized users may determination if the suspect is not reported to CACI. As a result, unknowingly allow individuals with authorized users may unknowingly allow individuals with a history a history of substantiated child of substantiated child abuse to have access to children. abuse to have access to children. 20 California State Auditor Report 2021-112 May 2022 CACI Incorrectly Identifies Some Individuals as Having a History of Child Abuse CACI erroneously contains some reports of child abuse that are not substantiated, which could lead to DOJ informing an authorized user that an individual is a perpetrator of child abuse when he or she has no associated report of substantiated child abuse. As a result, this erroneous information may limit that person’s employment or opportunity to care for children. In fact, we identified instances in which DOJ informed authorized users that individuals were a possible match with someone in CACI based on inaccurate information. For We identified 298 reports of the four years ending June 2021, we identified 298 reports of child child abuse in CACI that were not abuse in CACI that were not supported by the corresponding county supported by the corresponding records. Because these reports were in CACI, DOJ sent 25 letters county records. to authorized users notifying them that individuals were a possible match with a known child abuse suspect.4 As we discuss in the Introduction, state law requires the authorized user to follow up with the relevant county CWS agency for additional information, which could mitigate the impact of these errors. Additionally, according to DOJ, it informs individuals when it sends certain letters to authorized users of a possible match to a known child abuse suspect in CACI. However, even if the authorized user performs this follow-up, or the individual requests a grievance hearing to remove his or her erroneous information from CACI, the individual’s employment or opportunity to care for children may be inappropriately denied or delayed. We followed up on a sample of cases in CACI that were not supported by CWS/CMS records and found data inaccuracies in CWS/CMS as well as failures in the counties’ and DOJ’s processes. Specifically, for the 298 CACI reports, 24 were from the six counties we reviewed. We followed up with these six counties on all 24 reports in CACI that were not supported by CWS/CMS records. For three of those reports, we found that the counties had not recorded the cases as substantiated reports of child abuse in CWS/CMS even though investigators had substantiated the cases. However, the county subsequently submitted these three reports to DOJ and CACI appropriately reflected that the individuals had a history of child abuse. In three separate instances, the counties incorrectly submitted reports to DOJ about allegations of child abuse that did not meet the CACI reporting requirements. For example, Orange County investigated a mother and substantiated an allegation of general neglect of her children that, under state law, should not have been reported to DOJ for inclusion in CACI. 4 As discussed earlier, we also analyzed data for expedited background checks for the period preceding when we received CACI data in August 2021. We found that DOJ responded to an expedited request related to one individual who had a report of child abuse in CACI that was not supported by county records. As a result, DOJ may have inappropriately sent an expedited response letter indicating that the individual was a possible match with a known child abuse suspect in CACI. California State Auditor Report 2021-112 21 May 2022 In another four instances, the counties sent DOJ amended information to remove individuals from CACI, but DOJ failed to remove them. For example, Stanislaus County updated a sexual abuse allegation from substantiated to inconclusive as a result of a grievance hearing. Although the county sent DOJ both an amended CACI report and a request to remove the individual from CACI, DOJ failed to do so. As we discuss in the next section, this oversight may have occurred because DOJ did not have policies or procedures for the manual deletion of records. It also did not track requests for removals and did not have a process for verifying that removals are appropriate or complete. For the final 14 reports, the counties amended the outcomes of their investigations so that they were no longer substantiated, but they failed to update DOJ and request that DOJ remove the individuals’ reports from CACI. For example, Shasta County substantiated a mother’s alleged physical abuse of her son and submitted a CACI report to DOJ. However, the county then held a grievance hearing and changed the conclusion to inconclusive. Although the county changed the conclusion in CWS/CMS, it could not demonstrate that it sent a request to DOJ asking it to remove the record from CACI. In fact, the mother’s record remained in CACI in error. We also reviewed the policies and procedures for conducting CACI grievance hearings at the six counties to determine whether they conform to the laws and regulations requiring a hearing of objections to a suspect’s listing in CACI. Although we found that the counties generally adhere to those laws and regulations, we identified areas where some county polices do not meet these requirements. Specifically, three of the six counties—Contra Costa, Kern, and Stanislaus—do not have a policy allowing the suspect to challenge the impartiality of the grievance review officer. State regulations require that counties allow suspects to request the grievance review officer be disqualified on the grounds that a fair and impartial hearing cannot be held or a decision cannot be rendered. In addition, two of the six counties, Orange and Stanislaus, do not have a policy requiring that confidential evidence be returned to the county when the county provides a suspect with such evidence before a grievance hearing, which could result in the inappropriate release of sensitive or confidential information regarding the investigation. Finally, we found that three of the six counties—Calaveras, Contra Costa, and Shasta—lack policies for removing individuals from CACI if a grievance hearing determines that the allegations should not be substantiated. When CACI contains records of child abuse that are When CACI contains records of not accurate, individuals may be unjustifiably denied opportunities to child abuse that are not accurate, care for children, such as obtaining employment at a child care center individuals may be unjustifiably or adopting a child, or the individual may be inappropriately delayed denied opportunities to care from caring for children while the results of a grievance hearing are for children. transmitted to DOJ. 22 California State Auditor Report 2021-112 May 2022 DOJ Lacks Adequate Controls for Ensuring That CACI Contains Accurate and Appropriate Records We identified more than 36,000 DOJ’s inadequate system controls have resulted in CACI containing records for suspects that did not significant errors. In our electronic analysis of CACI data, we have a recorded date of birth, which identified more than 36,000 records for suspects that did not have prevents DOJ from removing certain a recorded date of birth. CACI suspect records that lack a date of records from CACI, as required by birth prevent DOJ from performing an important responsibility state law. under state law. Specifically, state law requires DOJ to remove suspects from CACI when the suspect reaches 100 years of age or when the suspect was a minor at the time of the incident and has had no subsequent CACI reports for 10 years. To address this removal requirement, DOJ developed daily automated processes in CACI to remove suspects who meet these requirements. However, when we reviewed these automated processes, we found that they only consider suspect records that have a valid date of birth. As a result, the 36,000 suspects with CACI records that do not contain a valid date of birth would never be removed from CACI without county or DOJ action to correct their records. Upon further inquiry, we determined that CACI lacked sufficient controls to ensure that staff enter all necessary information, including a suspect’s date of birth. After bringing this issue to its attention, DOJ modified the CACI system to require the suspect’s date of birth when entering new reports of child abuse into CACI. Further, the applicant services manager stated that DOJ is also developing a plan to address the 36,000 suspect records without a date of birth, and, as of April 2022, its efforts were ongoing. Further, DOJ cannot ensure that it appropriately removed records from CACI because it did not have policies or procedures for the manual deletion of records and its process lacked key controls. In addition to CACI’s automated processes for removing certain suspects’ records, DOJ also performs manual deletion of records at the request of counties when the county later determines that a report is not substantiated. However, this task has been performed independently by a single DOJ staff member, and DOJ did not have a process to verify that these deletions were appropriate. DOJ also did not notify the county that it had made the requested deletions unless the county specifically requested a notification. According to DOJ, as of April 2022, it requires supervisory approval before deleting CACI reports. However, because it only recently implemented this review, DOJ is unable to demonstrate that it has deleted all records as requested or that the more than 8,000 records it manually deleted as of August 2021 were appropriately removed. California State Auditor Report 2021-112 23 May 2022 Legislative Action Is Needed to Fix the State’s Error‑Prone and Inefficient Process for Entering Data Into CACI The State updates CACI using an outdated and inefficient process, which allows errors and omissions to persist undetected. Additionally, the process contains an inherent lag between when a county mails a report of child abuse to DOJ and when DOJ enters that suspect’s information into CACI. In fact, we found that it typically takes 28 days from the date that counties complete a report of child abuse to the date that DOJ enters the report into CACI. As a result of this lag time, an authorized user could request a background check on an individual and DOJ could report that the individual is not in CACI even if a county had substantiated an allegation of child abuse against that individual. Legislative action could improve this process by amending state law to grant DOJ direct access to the CWS/CMS system that county CWS agencies use to record the results of their child abuse investigations. The State’s Outdated and Inefficient Process Allows Errors and Omissions to Go Undetected The State’s process for updating CACI contains multiple steps where errors and omissions can occur and go undetected. In particular, the CACI process requires that counties print paper reports from CWS/CMS and mail them to DOJ, after which DOJ staff manually enter these reports into CACI. Additionally, if the reports are missing information, DOJ mails the reports back to counties to provide the missing information, and then the counties mail them back to DOJ. However, DOJ did not track the reports it sent back for correction. As we discuss above, we found numerous errors in nearly every phase We found numerous errors in nearly of the CACI process. For example, we reviewed 60 reports of child every phase of the CACI process. abuse and found that counties failed to send at least 14 reports they should have sent to DOJ. As we explained previously, this failure results in suspects with a history of substantiated child abuse not being added to CACI, reducing its usefulness in protecting children from individuals with a history of child abuse. We also identified individuals listed in CACI whose reports should have been removed, but the counties failed to ask DOJ to do so even though they had determined that the allegations were no longer substantiated. In addition, DOJ could not account for 28 missing reports that counties indicated they had sent for inclusion in CACI because DOJ did not have a process for identifying whether it received and input reports into CACI. Finally, we found accuracy errors in CACI, such as a lack of a date of birth for many suspects, misspellings of suspects’ names, and incorrect investigation reference numbers, which can hinder DOJ’s ability to quickly and reliably respond to CACI background checks. 24 California State Auditor Report 2021-112 May 2022 If the current process worked as designed, the reports in CACI would match the investigated, substantiated reports of child abuse in CWS/CMS. But as we previously discussed, the number of reports in CACI is less than half of the number of substantiated investigations of child abuse statewide in CWS/CMS for the four-year period ending June 2021. Further, we identified 298 individuals with reports in CACI that are not supported by information in the county records. Updating CACI takes far longer than In addition, because the process is outdated and inefficient, updating necessary, and its outdated and CACI takes far longer than necessary and increases the risk that DOJ inefficient process increases the risk is providing inaccurate information to authorized users. For example, that DOJ is providing inaccurate DOJ’s requirement for using physical mail and its manual data entry information to authorized users. process cause unnecessary delays in adding information to CACI, and the DOJ’s manual entry of reports greatly introduces the risk of errors. Specifically, it typically takes 28 days from the date that counties complete a child abuse report to the date that DOJ enters the report into CACI. During this time lag, which is inherent to the current process, an authorized user may request a background check for a suspect not yet entered into CACI, and DOJ would respond that the suspect is not in CACI. DOJ may still be able to notify an authorized user after later receiving a report of a suspect whom the authorized user has employed or allowed to have access to children. However, the delay would have prevented the authorized user from identifying information in a timely manner that could affect the user’s decision to allow the individual to care for children. Although it occurs less frequently, the same mailing and data entry time lag may occur when counties request that DOJ remove reports from CACI, leaving individuals in the database when they no longer have substantiated allegations of child abuse. DOJ has maintained this process of using physical mail even though the Legislature amended state law in 2000 to clarify that CACI reports may be sent by fax or electronic submission. According to the applicant services manager, in 2017 DOJ worked with CWS/CMS staff to develop an electronic submission process for CACI reporting, but this effort was not successful. However, she stated that, as of March 2022, DOJ and CWS/CMS staff have renewed discussions about transferring data electronically. Legislative Action Is Necessary to Improve CACI Reporting The CACI process must be improved in order to resolve current and future errors. As shown in Figure 3, although we identified three options for improving the CACI process, we recommend that DOJ have direct access to CWS/CMS as the most efficient option. Without major changes and legislative action, the issues we identified will likely persist and pose a significant challenge to CACI’s ongoing usefulness in protecting children from abuse. California State Auditor Report 2021-112 25 May 2022 Figure 3 Comparison of Options for Improving CACI Reporting 1 2 3 CURRENT DOJ has direct access Social Services and DOJ County CWS agencies and PROCESS to CWS/CMS build an electronic DOJ perform periodic interface to transmit reconciliations between (Recommended option) CWS/CMS data to CACI CWS/CMS and CACI PRO: PROs: PROs: PROs: • Reporting responsibilities • Eliminates reporting • Significantly reduces • No system changes to are unchanged and no delays and data reporting time. CACI or CWS/CMS legislative or regulatory entry errors. required. • Eliminates reliance on action is taken. • Eliminates reliance on postal mail, reducing • Helps DOJ ensure that all postal mail, reducing costs and time. required reports are costs and time. entered into CACI. CONs: • Improves accuracy of data • CACI reporting remains • Immediately gives DOJ entered into CACI. inefficient and prone access to complete data CONs: to errors. without needing to CONs: • Would require county research historical • CACI lacks many staff time to produce and differences between CACI • Would require Social thousands of suspects of mail CACI reports to DOJ. and CWS/CMS. Services and DOJ to substantiated child abuse. develop a new technical • DOJ would continue to • CACI inappropriately solution to regularly incur the cost of staff to CONs: contains data regarding transfer data between manually enter reports reports of child abuse that • Cannot be implemented CWS/CMS and CACI, which into CACI. are not substantiated. unless the Legislature could take a substantial • No improvement in amends state law to allow amount of time and has an • It takes DOJ a month to reporting time due to DOJ to access CWS/CMS. associated cost. receive and enter reports mailing and data entry of child abuse. • Social Services may need • Would require DOJ to requirements. to build a query or continue to maintain CACI • Would require significant specific view in CWS/CMS and ensure that it is up to work to reconcile the so DOJ staff can access date with CWS/ CMS. historical differences only CACI-related • CACI information between CACI and information. continues to substantially CWS/CMS data. duplicate information in CWS/CMS. • Would require significant work to reconcile historical differences between CACI and CWS/CMS data. Source: State Auditor analysis. 26 California State Auditor Report 2021-112 May 2022 Existing state law requires DOJ to act as the repository of CACI reports and requires a process for counties to submit reports of child abuse to DOJ. As we previously explained, with few exceptions, CACI should reflect all child abuse cases substantiated by county CWS agencies. Because these agencies It would be more efficient for DOJ enter substantiated cases of child abuse into CWS/CMS, we to have direct access to CWS/CMS believe it would be more efficient for DOJ to have direct access to for responding to CACI-related this system for responding to CACI-related inquiries and simply inquiries and simply eliminate the eliminate the cumbersome and ineffective CACI reporting process, cumbersome and ineffective CACI as shown in Figure 4. This direct access would not only remove the reporting process. problems of inaccurate data entry and missing reports in CACI, it would also remove the inherent reporting lag between a county’s substantiation of child abuse and DOJ’s entry of that information into CACI. Additionally, removing these reporting tasks could save DOJ staff an estimated $94,000 annually, based on its current workload, because staff would no longer need to transcribe and review reports. Further, the six counties we reviewed estimate that they would collectively save $35,000 annually because county staff would no longer need to prepare, review, and mail the CACI reports. However, because CWS/CMS contains more information than DOJ needs for responding to CACI background checks, such as allegations of child abuse that are not substantiated or substantiated cases involving minor suspects who have had no subsequent CACI reports for 10 years, DOJ would likely need to work with Social Services to determine how to identify only the information it needs for CACI reporting. Solutions for limiting the information DOJ has access to could include CACI-specific queries of CWS/CMS and training DOJ staff to navigate and interpret CWS/CMS information. A second option for addressing the problems we found with CACI is to have new reports of child abuse submitted electronically by transferring data from CWS/CMS to CACI. This option could ensure that data in CACI is accurate and would reduce the reporting delays. However, it would require Social Services and DOJ to develop a technical solution to transfer the data—which could take a substantial amount of time and have an associated cost. According to Social Services’ child welfare system branch chief, Social Services would not implement the solution until it begins using a new child welfare system beginning in fall 2023. In addition, this solution would require DOJ to maintain CACI and ensure its ongoing accuracy and completeness. Further, DOJ would have to work with Social Services and the counties to resolve the current significant gap we found in recorded cases between CWS/CMS and CACI. In addition, if this solution were implemented completely and accurately, CACI data would substantially duplicate information in CWS/CMS. However, these efforts would be unnecessary if DOJ were able to access CWS/CMS directly. California State Auditor Report 2021-112 27 May 2022 Figure 4 Recommended Revision to CACI Process COUNTY CHILD WELFARE SERVICES AGENCIES SUBSTANTIATE CASES OF CHILD ABUSE Removed Step County social worker Social worker enters County staff print the Supervisor reviews the investigates and the investigation into report of the incident. report and makes substantiates an CWS/CMS. changes, if necessary. incident of child abuse. County mails County staff perform additional the report work to revise the report. to DOJ. US Postal Service delivers the report back US Postal Service delivers the to the county child welfare services agency. report to DOJ in Sacramento. DOJ ENTERS INFORMATION INTO CACI DOJ mails the report back to the county to fill Missing information in missing information. DOJ evaluates whether the report is DOJ sorts and bundles mail for the Complete complete or missing information. unit that processes CACI reports. DOJ manually enters DOJ reviews the the report into CACI. data entry work. BACKGROUND CHECK DOJ RESPONDS TO BACKGROUND CHECKS ? Authorized user requests a child DOJ searches for the individual in DOJ prints and mails a abuse background check. CWS/CMS and generates either a response letter to the “no match” or a “possible match” letter. background check requester. Source: State regulations, county policies, and interviews with staff at DOJ and Calaveras, Contra Costa, Kern, Orange, Shasta, and Stanislaus counties. 28 California State Auditor Report 2021-112 May 2022 A third option that would reduce the errors in the current process is to establish a reconciliation process. In this option, Social Services would provide a regular and timely report from CWS/CMS to each county and to DOJ that lists the reports that each county substantiated and should have submitted to CACI. DOJ and the counties would then reconcile these reports against CACI data to determine whether the counties sent all required reports, and whether DOJ received and entered all reports. This reconciliation process would require the fewest technical changes to existing systems. However, it would not reduce the inefficiencies inherent in sending the reports by U.S. mail or those caused by counties needing to resubmit reports that are missing required information. Moreover, it would not reduce the resource-intensive and error-prone task of manually entering reports into CACI. The reconciliation process would also create additional costs in staff time for both DOJ and the counties. Finally, DOJ and the counties would still need to complete a significant amount of work to reconcile the already known discrepancies between the two systems. However, because counties and DOJ need to take immediate action to correct CACI in order to protect children, we believe that this third option is a necessary interim solution. Establishing DOJ’s access to CWS/CMS or developing a data transfer mechanism from CWS/CMS to CACI would require legislative or system changes that would take time to implement. Therefore, until a permanent solution is implemented, Social Services and DOJ should implement a reconciliation process to ensure that counties appropriately submit substantiated reports to DOJ and that DOJ enters all these reports into CACI. Please refer to the section beginning on page 3 to find the recommendations that we have made as a result of these audit findings. We conducted this performance audit in accordance with generally accepted government auditing standards and under the authority vested in the California State Auditor by Government Code section 8543 et seq. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on the audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Respectfully submitted, MICHAEL S. TILDEN, CPA Acting California State Auditor May 31, 2022 California State Auditor Report 2021-112 29 May 2022 Appendix A Statewide Statistical Information in CACI The scope and objectives of this audit requested specific statistics related to the CACI data. We present those statistics in the following tables. However, CACI does not contain more than half of the reports recorded in CWS/CMS statewide for the period of July 1, 2017, through June 30, 2021, as we describe in this report. Specifically, we found that CACI did not contain 27,000 reports of substantiated child abuse that were recorded in CWS/CMS. Further, we did not assess the completeness of the CACI data outside of this four-year period. Table A.1 CACI Reports of Child Abuse and Persons Listed on Those Reports From January 1997 to June 2021 NUMBER OF OTHER COUNTY NUMBER OF REPORTS NUMBER OF SUSPECTS NUMBER OF VICTIMS INDIVIDUALS REFERENCED IN THESE REPORTS* Alameda 5,773 5,773 7,014 8,176 Alpine 14 14 16 11 Amador 129 129 171 255 Butte 3,349 3,349 3,992 4,906 Calaveras 624 624 798 869 Colusa 121 121 155 163 Contra Costa 3,940 3,940 4,969 6,155 Del Norte 428 428 522 754 El Dorado 1,084 1,084 1,313 1,888 Fresno 5,988 5,988 7,597 11,127 Glenn 555 555 683 1,095 Humboldt 1,732 1,732 2,132 2,849 Imperial 838 838 1,202 873 Inyo 469 469 547 883 Kern 8,698 8,698 10,853 14,533 Kings 1,628 1,628 1,928 2,291 Lake 311 311 367 518 Lassen 622 622 770 639 Los Angeles 69,506 69,506 91,075 84,960 Madera 2,171 2,171 2,652 3,656 Marin 1,037 1,037 1,237 1,449 Mariposa 166 166 208 312 Mendocino 1,480 1,480 1,818 1,945 Merced 2,777 2,777 3,604 3,824 continued on next page . . . 30 California State Auditor Report 2021-112 May 2022 NUMBER OF OTHER COUNTY NUMBER OF REPORTS NUMBER OF SUSPECTS NUMBER OF VICTIMS INDIVIDUALS REFERENCED IN THESE REPORTS* Modoc 296 296 329 382 Mono 119 119 138 241 Monterey 3,315 3,315 4,045 4,816 Napa 736 736 823 1,297 Nevada 514 514 587 528 Orange 45,409 45,409 57,228 90,546 Placer 4,159 4,159 5,448 4,260 Plumas 592 592 693 464 Riverside 15,287 15,287 19,191 21,755 Sacramento 10,518 10,518 13,852 14,318 San Benito 886 886 1,057 954 San Bernardino 22,497 22,497 28,133 29,311 San Diego 37,142 37,142 52,803 53,353 San Francisco 2,744 2,744 3,231 3,990 San Joaquin 7,160 7,160 8,823 12,921 San Luis Obispo 2,312 2,312 3,004 3,101 San Mateo 3,024 3,024 3,533 3,469 Santa Barbara 3,673 3,673 4,408 8,047 Santa Clara 7,245 7,245 8,651 7,573 Santa Cruz 2,424 2,424 3,151 3,537 Shasta 2,562 2,562 3,542 5,236 Sierra 16 16 22 18 Siskiyou 629 629 795 1,075 Solano 3,184 3,184 3,694 5,055 Sonoma 3,167 3,167 3,783 4,043 Stanislaus 5,449 5,449 6,680 11,532 Sutter 613 613 756 901 Tehama 351 351 434 632 Trinity 141 141 179 265 Tulare 1,493 1,493 1,721 2,428 Tuolumne 944 944 1,143 1,422 Ventura 4,996 4,996 6,091 8,676 Yolo 1,137 1,137 1,358 1,602 Yuba 992 992 1,212 1,459 Totals 309,166 309,166 396,161 463,338 Source: DOJ’s CACI database as of August 16, 2021. Note: This table counts suspects, victims, and other individuals each time they are listed on a report. * This category includes individuals listed on child abuse reports who were not identified as the suspect or the victim, such as siblings who were not abused. California State Auditor Report 2021-112 31 May 2022 Table A.2 CACI Reports Submitted Before January 2005 NUMBER OF REPORTS COUNTY BEFORE JANUARY 2005 Alameda 18,423 Alpine 29 Amador 223 Butte 5,022 Calaveras 1,034 Colusa 218 Contra Costa 12,305 Del Norte 1,412 El Dorado 1,117 Fresno 16,567 Glenn 730 Humboldt 3,074 Imperial 1,618 Inyo 512 Kern 17,229 Kings 1,854 Lake 725 Lassen 997 Los Angeles 127,072 Madera 2,795 Marin 2,516 Mariposa 178 Mendocino 2,209 Merced 2,623 Modoc 216 Mono 112 Monterey 5,599 Napa 672 Nevada 1,219 Orange 79,982 Placer 3,518 Plumas 1,193 Riverside 22,740 Sacramento 26,049 San Benito 794 San Bernardino 40,413 San Diego 45,348 San Francisco 6,337 San Joaquin 10,907 continued on next page . . . 32 California State Auditor Report 2021-112 May 2022 NUMBER OF REPORTS COUNTY BEFORE JANUARY 2005 San Luis Obispo 4,830 San Mateo 6,871 Santa Barbara 2,860 Santa Clara 19,976 Santa Cruz 3,807 Shasta 1,638 Sierra 65 Siskiyou 964 Solano 5,959 Sonoma 6,704 Stanislaus 14,426 Sutter 1,231 Tehama 1,033 Trinity 72 Tulare 5,454 Tuolumne 1,299 Ventura 12,479 Yolo 1,650 Yuba 1,745 County not specified Less than 10 Total 558,644 Source: DOJ’s CACI database as of August 16, 2021. Note: To maintain the confidentiality of small groups of children, we redacted groups of less than 10. Therefore, the total excludes locations with values less than 10. California State Auditor Report 2021-112 33 May 2022 Table A.3 Victims and Suspects Listed in Substantiated CACI Reports From January 1991 to December 2004 COUNTY NUMBER OF SUSPECTS NUMBER OF VICTIMS Alameda 2,669 3,236 Alpine Less than 10 Less than 10 Amador 14 29 Butte 1,816 2,195 Calaveras 177 218 Colusa 31 35 Contra Costa 2,034 2,675 Del Norte 201 258 El Dorado 276 323 Fresno 2,100 2,800 Glenn 153 173 Humboldt 714 864 Imperial 442 624 Inyo 181 203 Kern 3,472 4,526 Kings 741 887 Lake 185 224 Lassen 180 207 Los Angeles 22,027 28,016 Madera 948 1,128 Marin 203 223 Mariposa 53 72 Mendocino 728 931 Merced 901 1,123 Modoc 87 98 Mono 26 32 Monterey 1,220 1,440 Napa 293 313 Nevada 233 277 Orange 24,330 33,648 Placer 1,769 2,278 Plumas 325 372 Riverside 6,783 9,038 Sacramento 6,164 8,449 San Benito 405 471 San Bernardino 9,800 12,361 San Diego 19,291 29,373 San Francisco 963 1,084 continued on next page . . . 34 California State Auditor Report 2021-112 May 2022 COUNTY NUMBER OF SUSPECTS NUMBER OF VICTIMS San Joaquin 1,829 2,216 San Luis Obispo 1,248 1,705 San Mateo 1,107 1,248 Santa Barbara 1,490 1,780 Santa Clara 3,026 3,644 Santa Cruz 1,102 1,406 Shasta 543 733 Sierra Less than 10 Less than 10 Siskiyou 281 385 Solano 1,490 1,739 Sonoma 1,399 1,660 Stanislaus 2,345 2,880 Sutter 291 359 Tehama 68 80 Trinity 12 12 Tulare 664 781 Tuolumne 495 608 Ventura 2,818 3,490 Yolo 261 319 Yuba 361 428 Totals 132,765 175,677 Source: DOJ’s CACI database as of August 16, 2021. Note: This table counts suspects and victims each time they are listed on a report. To maintain the confidentiality of small groups of children, we redacted groups of less than 10. Therefore, the totals exclude locations with values less than 10. California State Auditor Report 2021-112 35 May 2022 Table A.4 Victims and Suspects Listed in CACI Reports by Sex From January 1965 to August 2021 NUMBER OF SUSPECTS NUMBER OF VICTIMS Female 231,223 506,611 Male 460,045 342,713 Unknown 22,565 20,267 Totals 713,833 869,591 Source: DOJ’s CACI database as of August 16, 2021. Note: This table counts suspects and victims each time they are listed on a report. Table A.5 Victims and Suspects Listed in CACI Reports by Race/Ethnicity as Listed on the Report From January 1965 to August 2021 RACE/ETHNICITY NUMBER OF SUSPECTS NUMBER OF VICTIMS American Indian 4,233 5,249 Asian Indian 905 1,085 Black 88,021 107,161 Cambodian 613 849 Chinese 2,493 2,852 Filipino 3,942 5,136 Guamanian 159 173 Hawaiian 629 549 Hispanic 239,838 302,046 Japanese 424 518 Korean 875 991 Laotian 629 933 Other Asian 8,507 9,941 Pacific Islander 2,856 3,125 Samoan 1,178 1,333 Vietnamese 2,750 3,480 White 286,197 354,619 Other 8,016 10,398 Unknown 61,568 59,153 Totals 713,833 869,591 Source: DOJ’s CACI database as of August 16, 2021. Note: This table counts suspects and victims each time they are listed on a report. 36 California State Auditor Report 2021-112 May 2022 Table A.6 Victims Listed in CACI Reports by Age From January 1965 to August 2021 NUMBER OF VICTIMS AS OF THE DATE OF THE INCIDENT AGE RANGE OF CHILD ABUSE Less than 1 year old 41,916 1–2 years old 74,543 3–6 years old 204,365 7–10 years old 212,801 11–14 years old 219,065 15–17 years old 112,206 18 years old or older 621 No age recorded 2,312 Age less than zero 1,762 Total 869,591 Source: DOJ’s CACI database as of August 16, 2021. Note: This table counts victims each time they are listed on a report. Table A.7 Suspects Listed in CACI Reports by Age From January 1965 to August 2021 NUMBER OF SUSPECTS AS OF THE DATE OF THE AGE RANGE INCIDENT OF CHILD ABUSE Less than 10 years old 628 10–18 years old 23,159 19–29 years old 220,050 30–39 years old 263,425 40–49 years old 121,921 50–59 years old 35,858 60–69 years old 10,322 70–79 years old 1,634 80–89 years old 116 Age not recorded 36,698 Illogical data 22 Total 713,833 Source: DOJ’s CACI database as of August 16, 2021. Note: This table counts suspects each time they are listed on a report. California State Auditor Report 2021-112 37 May 2022 Table A.8 Types of Child Abuse Reported in CACI Reports From January 1965 to August 2021 TYPE OF NUMBER OF REPORTS PERCENTAGE ABUSE OR NEGLECT Mental or Emotional 110,610 14.05% Suffering Physical Injury 374,661 47.59 Severe Neglect 61,850 7.86 Sexual Abuse, Assault, or 235,393 29.90 Exploitation Unlawful Corporal 409 0.05 Punishment or Injury Willful Harming or 1,204 0.15 Endangerment Other or Unidentified 3,150 0.40 Totals 787,277 100.00% Source: DOJ’s CACI database as of August 16, 2021. Note: Because a report can contain multiple types of abuse or neglect, the total number of reports in this table exceeds the total number of unique reports. Table A.9 Number of Victims and Suspects by Type of Report From January 1965 to August 2021 TYPE OF NUMBER OF SUSPECTS NUMBER OF VICTIMS REPORT DETERMINATION Suspected Abuse 249,907 287,417 Substantiated Abuse 292,971 376,483 Investigation Initiated 170,955 205,691 Totals 713,833 869,591 Source: DOJ’s CACI database as of August 16, 2021. Note: This table counts suspects and victims each time they are listed on a report. While CACI contains reports with these three determinations, for the period from July 2017 through June 2021 CACI only contained, and we only evaluated, reports of substantiated abuse. Table A.10 Reported Incidents Removed From the CACI by Requester From January 1965 to August 2021 NUMBER OF REPORTED ENTITY INITIATING REMOVAL INCIDENTS REMOVED DOJ 78,349 Reporting Agency 8,032 Not Listed 15,231 Total 101,612 Source: DOJ’s CACI database as of August 16, 2021. 38 California State Auditor Report 2021-112 May 2022 Blank page inserted for reproduction purposes only. California State Auditor Report 2021-112 39 May 2022 Appendix B Scope and Methodology The Joint Legislative Audit Committee (Audit Committee) directed the California State Auditor to conduct an audit of CACI as administered by DOJ to determine whether CACI contains a complete and accurate set of reports of child abuse. Table B lists the objectives that the Audit Committee approved and the methods we used to address them. Table B Audit Objectives and the Methods Used to Address Them AUDIT OBJECTIVE METHOD 1 Review and evaluate the laws, rules, and Reviewed and evaluated state laws and regulations, as well as state and county policies, regulations significant to the audit objectives. procedures, and guidance for reporting child abuse suspects to CACI. 2 Evaluate whether CACI is an effective tool for • Obtained CACI and CWS/CMS data and performed analysis to match records of child investigatory purposes, including the extent to abuse between the two systems for the period of July 1, 2017, through June 30, 2021. which reporting agencies submit accurate and • Selected six counties—Calaveras, Contra Costa, Kern, Orange, Shasta, and Stanislaus—to complete reports of abuse and severe neglect. review based on a number of factors, including population and number of CACI reports. • Reviewed county policies and procedures and interviewed county staff regarding CACI reporting processes. • Interviewed DOJ, Social Services, and county staff, and analyzed data to identify discrepancies between CACI data and CWS/CMS data. Reviewed associated county case files. • Reviewed CACI response letters to determine whether the letters contained the same information as recorded in CWS/CMS. 3 Determine whether DOJ has complied with • Interviewed DOJ staff to understand CACI’s automated purge processes as well as the state law to remove reports from CACI that do process of manually removing reports from CACI at the request of the reporting agency. not meet minimum legal requirements. • Reviewed source code of CACI’s automated purge processes for removing suspects that meet specific legal criteria. • Reviewed county policies and procedures, and interviewed county staff regarding processes for requesting removal of reports from CACI. 4 For a selection of reporting agencies, evaluate Reviewed county policies and procedures, and interviewed county staff regarding grievance the grievance process and determine whether hearing processes. the reporting agencies have adequate policies and procedures to receive and review objections to an individual’s listing in CACI. 5 From 1997 to the present, assess whether Performed electronic analysis of CACI data, and calculated numbers of reports entered into parties complied with state law for CACI CACI and various related statistics. reporting requirements by determining the following: a. The number of reports DOJ received and entered into CACI by county. b. The number of individuals listed as suspects, victims, and others on these reports. continued on next page . . . 40 California State Auditor Report 2021-112 May 2022 AUDIT OBJECTIVE METHOD 6 To the extent possible, use data from the CACI to • Performed electronic analysis of CACI data, and calculated numbers of reports entered determine the following: into CACI and various related statistics. a. The number of records that are based on • Performed electronic analysis of CACI data to identify the number of records removed reports submitted before January 1, 2005. from the system and the reasons for removal. b. The number of victims and suspects • Reviewed DOJ’s source code for daily automated processes to remove suspects from CACI referenced in substantiated reports who reach 100 years of age or were minors at the time of the incident and have had no submitted from 1991 to 2004. subsequent CACI reports for 10 years. c. Demographic information for victims and suspects by age, race, and gender. • Interviewed DOJ staff to understand CACI’s automated purge processes as well as the process of manually removing reports from CACI at the request of the reporting agency. d. The number and percentage of reports by the type of abuse or neglect reported. e. The number of victims and suspects included in reports of substantiated or suspected abuse or neglect. f. Whether individuals have been appropriately removed from the CACI data. Specifically, determine whether (1) individuals who were at least 100 years old have been removed, (2) suspects who were younger than 18 years old at the time of the incident have been removed if more than 10 years has passed without a subsequent report, and (3) individuals have been removed at the request of the submitting agency. 7 Review and assess any other issues that are None identified. significant to the audit. Source: Audit workpapers. Assessment of Data Reliability The U.S. Government Accountability Office, whose standards we are statutorily obligated to follow, requires us to assess the sufficiency and appropriateness of computer-processed information that we use to support our findings, conclusions, or recommendations. In performing this audit, we relied on CACI data we obtained from DOJ and CWS/CMS data we obtained from Social Services. To evaluate the CACI data, we reviewed existing information about the data, interviewed staff members knowledgeable about the data, reviewed selected source code related to automated purges of records, and performed electronic testing of the data. For the CWS/CMS data, we performed electronic analysis to match records of child abuse between the two systems for the period of July 1, 2017, through June 30, 2021. We then performed case file reviews for a selection of records that matched between the two systems as well as a selection of records that were only found in CACI and a selection of records that were only found in CWS/CMS. Although we were able to match nearly all records in CACI to records in CWS/CMS, we found that CACI contained fewer than half of the records contained in CWS/CMS for this time period. As a result, we determined that the CACI data California State Auditor Report 2021-112 41 May 2022 were not sufficiently reliable for the purpose of determining the number and content of reports of child abuse for the period from July 1, 2017, through June 30, 2021, and the data from CWS/CMS was of undetermined reliability. Although we recognize that data limitations may affect the precision of some of the numbers we present, there is sufficient evidence in total to support our audit findings, conclusions, and recommendations. 42 California State Auditor Report 2021-112 May 2022 Blank page inserted for reproduction purposes only. California State Auditor Report 2021-112 43 May 2022 44 California State Auditor Report 2021-112 May 2022 California State Auditor Report 2021-112 45 May 2022 * 1 * California State Auditor’s comments begin on page 55. 46 California State Auditor Report 2021-112 May 2022 1 2 California State Auditor Report 2021-112 47 May 2022 3 4 48 California State Auditor Report 2021-112 May 2022 5 6 7 California State Auditor Report 2021-112 49 May 2022 8 9 50 California State Auditor Report 2021-112 May 2022 5 10 California State Auditor Report 2021-112 51 May 2022 10 10 52 California State Auditor Report 2021-112 May 2022 11 12 California State Auditor Report 2021-112 53 May 2022 54 California State Auditor Report 2021-112 May 2022 Blank page inserted for reproduction purposes only. California State Auditor Report 2021-112 55 May 2022 Comments CALIFORNIA STATE AUDITOR’S COMMENTS ON THE RESPONSE FROM THE CALIFORNIA DEPARTMENT OF JUSTICE To provide clarity and perspective, we are commenting on the response to our audit from DOJ. The numbers below correspond to the numbers we have placed in the margin of the response. 1 At no point does our audit report suggest that DOJ does not believe that children should be protected or that individuals’ rights should be protected. Further, our report does not overstate or inflate DOJ’s role in regards to CACI. Rather, we accurately describe DOJ’s and the counties’ roles on pages 7 through 11 of our report. 2 One of DOJ’s statutory roles in CACI is to accurately maintain the information it receives from counties. However, as discussed on page 15, out of the 60 reports we reviewed, counties were able to provide evidence that they finalized 29 of these reports and they assert that they sent these reports to DOJ via the US Post Office, as directed by DOJ. Although DOJ entered one of these reports into CACI after we received the data, the remaining 28 reports were not in CACI. As we note on pages 16 and 17, because DOJ did not track the reports it received from counties or the reports it sent back to them for correction, it was unable to verify why these reports are missing from CACI. 3 Our report does not ignore the reasons for differences between the number of reports in CWS/CMS and the number of reports in CACI. Rather, we explored the reasons for this discrepancy and describe the results of our review beginning on page 15. 4 Our conclusions are not based on faulty assumptions, but rather on an evaluation of the evidence that the counties and DOJ were able to provide. As shown in the Table on page 16 and as discussed on page 15, counties were able to provide evidence of these 29 finalized reports in their case files and assert that they sent these reports to DOJ via the US Post Office, as directed by DOJ. Although DOJ stated that it would have returned 15 of these reports because they were missing information, DOJ did not track all reports it received or reports it sent back to counties, and is therefore unable to support its assertion that it is highly likely the reports were returned to the county to provide missing information or were never received. 56 California State Auditor Report 2021-112 May 2022 5 State law governing our audits prohibits us from sharing confidential information between auditees. We provided all of the critical information to which DOJ has legal access and which we could lawfully share prior to DOJ sending its written response. However, Social Services has legal authority over some of the critical information DOJ needs to follow up on specific child abuse reports missing from CACI. We provided this information to Social Services and encouraged it to enter into an agreement with DOJ to share this information as soon as possible. 6 We carefully considered the differences between CACI and CWS/ CMS, especially as they relate to the population of records that meet the criteria for inclusion in CACI. As discussed on page 7, we considered only cases of child abuse and severe neglect, and on page 18 we describe that cases of general neglect are not reported to DOJ for inclusion in CACI. 7 Contrary to DOJ’s assertion, we considered the provision regarding active investigations, which we discuss beginning on page 18 of our report. Further, our second recommendation to the Legislature, that it amend state law to require all reports of substantiated child abuse to be included in DOJ’s background checks, is in response to this specific issue. However, some of this information was redacted in the draft report we provided to DOJ because it was related to other entities. 8 As DOJ acknowledges in its response, DOJ’s suggestion for the Legislature to amend state law to require Social Services and county CWS agencies to check CWS/CMS would only apply to Social Services and county CWS agencies. This recommendation would not apply to the many other types of authorized users of CACI discussed in the text box on page 7. Also, to be clear, our audit did not establish—or attempt to establish—that Social Services and county CWS agencies are not already checking CWS/CMS prior to making placement and licensing decisions. 9 We note that DOJ agrees with all of our recommendations despite its concern that the report needs additional contextual information. 10 DOJ refers to actions that it began taking at the end of our audit after we shared our findings and recommendations. We are glad to hear that DOJ is taking positive steps toward implementing those recommendations and we look forward to reviewing its progress. 11 As discussed beginning on page 14 of our audit report and in our recommendation, DOJ needs to begin retaining all responses to its expedited background check process. Because DOJ does not track these responses for longer than two months, it cannot reliably determine if its response indicated whether an individual matched California State Auditor Report 2021-112 57 May 2022 information in CACI. In the event that DOJ learns of additional reports of child abuse that should have been in CACI, DOJ does not know when it is appropriate to send a corrected letter to authorized users who still have a right to the information. 12 Although DOJ asserts that many of the CACI records lacking birth dates are from prior to 2009, DOJ’s response indicates that 1,000 of these records were entered after 2008. While DOJ recently developed controls in CACI to require a birth date for all new records, it is still important for DOJ to research and correct all 36,000 reports lacking birth dates to ensure it removes individuals who no longer meet the CACI requirements. 58 California State Auditor Report 2021-112 May 2022 Blank page inserted for reproduction purposes only. California State Auditor Report 2021-112 59 May 2022 May 12, 2022 Michael S. Tilden, CPA* Acting California State Auditor California State Auditor 621 Capitol Mall, Suite 1200 Sacramento, CA 95814 SUBJECT: CDSS RESPONSE TO CALIFORNIA STATE AUDITOR’S REPORT Dear Michael Tilden: This letter is in response to the recommendations identified for the California Department of Social Services (CDSS) in the California State Auditor’s (CSA) Report 2021-112 entitled The Child Abuse Central Index. The CDSS is committed to strengthening existing processes to improve the accuracy and efficiency of reporting to the Child Abuse Central Index (CACI) by local child welfare services agencies in a manner which supports the protection of children, while also providing thoughtful consideration of the privacy and confidentiality of families involved with the child welfare system and appropriate protections of the due process rights of individuals whose names are submitted to the CACI. Additionally, the CDSS is committed to supporting exploration of policies that may increase the fairness and equity of the CACI, which has received criticism as unfairly and inappropriately impacting individuals whose names were submitted to the index. Below you will find the CDSS response to the recommendations in the CSA Report. CDSS appreciates the opportunity to further discuss these recommendations with the CSA. CSA Recommendation #1 Immediately develop a process to collaborate with the Department of Justice (DOJ) and counties to review the list of 27,000 reports of substantiated child abuse that were not in CACI and ensure all eligible missing reports are forwarded to DOJ. * California State Auditor’s comments begin on page 65. 60 California State Auditor Report 2021-112 May 2022 Michael S. Tilden Page Two CDSS Response: The CDSS is committed to working in partnership with counties and the DOJ to develop interagency collaborative processes that may be used to effectively and efficiently identify whether reports are being appropriately submitted to the CACI. Any processes developed must be consistent with existing confidentiality laws and the established CACI due process procedures. The CDSS will take the following steps to assess and develop these interagency collaborative processes: • Meet with county child welfare directors and relevant county staff to determine mutually agreed upon protocols to provide each county with a list of their county’s 1 reports for further review and assessment, as appropriate; • Meet with the DOJ to explore whether CACI data may be provided to CDSS and counties for reconciliation purposes, and establish any necessary data sharing agreements; • Provide technical assistance, training, and issue state guidance to support county practice; and • Assess what resources may be necessary to successfully implement any new procedures. 2 The CDSS recently received the CSA’s methodology for identifying these reports on May 10, 2022, and is currently assessing this methodology and data. It is critical to note that while existing data fields indicate a substantiated allegation in the Child Welfare 3 Services/Case Management System (CWS/CMS), additional review is necessary to determine whether the report met all criteria under state law for submitting an individual’s name for purposes of CACI reporting. In order to assess and verify whether an individual’s name should have been submitted to the CACI based upon a substantiated allegation in CWS/CMS, the CDSS will partner with counties to assess establishing protocols and the resources needed to complete a qualitative review for 4 each of the 27,000 reports, including a review of investigation narratives and logs, in order to verify the following requirements were met for submission to the CACI: • There is sufficient identifying information regarding the alleged perpetrator to fully and accurately complete and submit the CACI report in accordance with Section 901 of Title 11 of the California Code of Regulations; • The facts underlying the substantiated allegation meet the specific definition(s) of child abuse and severe neglect described in Penal Code Sections 11165 through 11165.6 that are used for reporting to the CACI; • The local county child welfare agency conducted an active investigation of the report and determined the allegation to be substantiated, as required by Penal Code Section 11169(a); and California State Auditor Report 2021-112 61 May 2022 Michael S. Tilden Page Three • The allegation was not subsequently determined to be unsubstantiated through a 5 grievance hearing or court proceeding. Furthermore, in partnering with counties to develop any necessary protocols, CDSS will provide technical assistance to support compliance with the required due process procedures when a name is submitted to the CACI, including appropriate notice to such individuals that have been listed on the CACI and their right to a grievance hearing. CSA Recommendation #2 By November 2022, develop monthly reports from CWS/CMS of cases of child abuse substantiated during the month and another list of cases that changed from substantiated to not substantiated, and then provide these reports to the counties and to DOJ. CDSS Response: The CDSS agrees with the importance of counties reporting accurate information to the CACI and is committed to providing support and technical assistance to counties to strengthen the accuracy and completeness of CACI reports. However, because a list of substantiated allegations documented in CWS/CMS requires more nuanced analysis of whether a report met the required criteria for submission to the CACI, the process 6 described in this recommendation may not accomplish our collective goal. To determine how existing data may be most effectively leveraged to strengthen county reporting to CACI, CDSS will: • Assess whether existing functionality within CWS/CMS supports the feasibility of 7 generating proposed reports to the counties; • Meet with county child welfare directors and relevant county staff to determine 1 what data and protocols will effectively provide counties with additional tools to strengthen CACI reporting; • Meet with the DOJ to explore whether CACI data may be provided to CDSS and counties for ongoing reports and reconciliation purposes, and establish any necessary data sharing agreements; • Provide technical assistance, training, and issue state guidance to support county practice; and • Assess what resources may be necessary to successfully implement any new procedures. 62 California State Auditor Report 2021-112 May 2022 Michael S. Tilden Page Four CSA Recommendation #3 By November 2022, ensure that all counties develop policies and procedures to review the monthly reports produced by Social Services and ensure that they have sent all appropriate reports to DOJ. CDSS Response: The CDSS is committed to partnering with counties and the DOJ to develop appropriate ongoing reconciliation processes to strengthen county reporting to the CACI, including issuing state guidance for existing and new procedures. Counties update the policies and procedures of their child welfare program according to CDSS policy guidance typically issued through All County Letters (ACL) or regulation updates. To support county updates to their local policies, the CDSS will take the following course of action: • Develop and issue an ACL providing counties with written guidance on their ongoing duties and responsibilities to ensure accurate and timely data entry into CWS/CMS as well as the commitment to submit CACI reports to the DOJ by counties that receive optional Interagency Child Abuse and Neglect (ICAN) block grant funding. • Develop and issue state guidance on any review and reconciliation procedures established for CACI reports, including procedures for county child welfare agencies to receive any data reports, how to reconcile potential discrepancies identified by the reports, and how to ensure reports are submitted correctly or identified as inappropriate for submittal. 8 The CDSS anticipates the reconciliation process will be a large workload for county child welfare agencies to complete as they will need to complete a qualitative review for all cases to correctly verify which substantiated reports should have been listed on the CACI. Only counties receiving the optional ICAN block grant funding are required to continue submitting reports to DOJ for the purposes of listing a perpetrator on the CACI. If counties opt-out, they are not required to report. Requiring counties to participate in this new reconciliation process could have potential unintended consequences. County 9 child welfare agencies may choose to opt-out of receiving the ICAN Block Grant funds and discontinue reporting to the CACI in subsequent fiscal years due to the county not having the resources to be able to support this new activity. CSA Recommendation #4 By November 2022, collaborate with DOJ to identify and reconcile all reports that should have been submitted to CACI by counties and work with counties to enter all reports California State Auditor Report 2021-112 63 May 2022 Michael S. Tilden Page Five into CACI by May 2023. This collaboration should not be limited to reports of our four-year audit period. CDSS Response: The CDSS is committed to collaborating with counties and DOJ to determine the most effective solution for the reconciliation of records in a manner consistent with existing confidentiality laws and due process requirements. The process will also be dependent upon DOJ’s ability to provide CACI information for a reconciliation process to help strengthen accurate and consistent CACI reporting by county child welfare agencies. Additionally, any process for counties to submit reports from prior years will require thoughtful assessment of whether sufficient due process can be provided. CSA’s Recommendation Impacting CWS/CMS: The Legislature should amend state law to require DOJ to directly access and review CWS/CMS system data. CDSS Response: The CDSS supports exploring alternative opportunities to leverage existing data to improve the accuracy of CACI reporting, including CDSS and county access to CACI data for reconciliation purposes. Any proposed access to local child welfare data contained in CWS/CMS by another entity must thoughtfully consider the confidentiality and privacy of families involved with the child welfare system, the due process protections for individuals whose names are submitted to the CACI, and the technical capabilities and limitations of the existing system. The CWS/CMS holds underlying 10 investigation and case information involving families who receive child welfare services that is strictly confidential under state and federal law. The CWS/CMS is a confidential case management system and was not designed to provide access to specific data for purposes of a CACI background check as proposed by the CSA. Due to the current technical limitations of the CWS/CMS, there is not currently a confidential and secure way to grant the DOJ access to the CWS/CMS without also granting access to all referral and case data, including information of individuals whose names are not reportable to CACI. Additionally, it is not feasible to make changes to the current legacy system due to the existing governance process, specifically how system changes are requested, developed, and implemented. The technical aspects involved to create a new level of restrictive access as stated above would be subject to building a case for a business need. Given the system’s limited technical capabilities and existing structure, making system changes to the CWS/CMS requires additional funding and contractual 64 California State Auditor Report 2021-112 May 2022 Michael S. Tilden Page Six amendments and at a minimum involves a comprehensive analysis process to analyze, estimate costs, and develop any changes before implementation could take place. The CWS/CMS will be decommissioned and replaced with the Child Welfare Services-California Automated Response Engagement System (CWS-CARES). Child safety is of utmost importance to CDSS, and CDSS will explore all opportunities to improve information sharing and data quality. The new case management system in development, CWS-CARES, has existing plans to exchange CACI information with the DOJ, where feasible and appropriate. The implementation of a data exchange between CACI and CWS-CARES would allow for proper consideration of children, youth, and 11 families’ confidentiality rights and maintain appropriate separation between the two systems, which serve distinct statutory purposes. Additionally, it could improve the accuracy and timeliness of CACI information submitted to DOJ. RESPONSE FOLLOW UP Questions or requests for clarification regarding the information in this letter should be directed to Debbie Richardson, Chief, Office of Audit Services at Debbie.Richardson@dss.ca.gov. Sincerely, KIM JOHNSON Director California State Auditor Report 2021-112 65 May 2022 Comments CALIFORNIA STATE AUDITOR’S COMMENTS ON THE RESPONSE FROM THE CALIFORNIA DEPARTMENT OF SOCIAL SERVICES To provide clarity and perspective, we are commenting on the response to our audit from Social Services. The numbers below correspond to the numbers we have placed in the margin of the response. 1 Social Services’ list of steps it indicates it will take notably lacks a key activity: sharing with DOJ the list of 27,000 reports of child abuse in CWS/CMS, which were not in CACI. We provided this list to Social Services and asked that it enters into a data sharing agreement and then share the data with DOJ. As we discussed on page 14, DOJ has already provided responses to authorized users stating that at least 224 individuals do not have a history of child abuse even though that same individual has substantiated reports of child abuse in CWS/CMS. It is crucial that Social Services share with DOJ the full list of 27,000 reports of child abuse from CWS/CMS so that DOJ can work with counties to prioritize researching and submitting any eligible missing reports of child abuse. DOJ can then send revised letters to authorized users, as appropriate. 2 In November 2021, Social Services staff provided us system documentation from CWS/CMS, which outlined how to identify reports of substantiated child abuse. We relied on this documentation, as well as multiple discussions with Social Services’ staff, when developing our methodology and conducting our analysis. We also reviewed in detail a selection of 60 substantiated child abuse reports missing from CACI. Based on our review of these 60 reports, we understand that some portion of the 27,000 missing reports will ultimately be determined to not meet the criteria to be in CACI. However, we are convinced by the evidence we have analyzed that the majority of these 27,000 child abuse reports do need to be in CACI and that Social Services needs to act swiftly to help DOJ protect children. 3 We acknowledge that not all 27,000 reports of substantiated child abuse in CWS/CMS may be eligible for CACI and that additional review is necessary to determine whether these reports meet the criteria for inclusion in CACI. Therefore, we do not recommend that all of these reports be summarily entered into CACI. Instead, we recommend that Social Services immediately develop a process to collaborate with DOJ and counties to review this list. 66 California State Auditor Report 2021-112 May 2022 4 We recognize that reports of child abuse must meet certain requirements to be included in CACI and our analysis accounted for these requirements when there was sufficient data to do so. As a result, and as we discuss on page 15, we determined that 52 of the 60 child abuse reports we reviewed met the reporting requirements and should have been included in CACI. 5 We recognize that grievance hearings and court proceedings can result in an allegation no longer being substantiated, and we accounted for this factor in our data analysis. Specifically, while we evaluated reports of child abuse for the four-year period ending June 2021, we removed any reports of child abuse which were no longer substantiated as of November 2021—the date we received a copy of Social Services’ CWS/CMS data. 6 We recognize that a nuanced analysis is required to determine whether a report belongs in CACI. That is why we recommend that Social Services develop monthly reports of newly substantiated reports of child abuse and furnish them to the counties, and ensure that counties review these reports against the CACI reports that they develop and send to DOJ each month. 7 It is unclear why Social Services needs to assess whether CWS/CMS could generate reports of substantiated child abuse when we used this same data to conduct our analysis identifying these discrepancies. 8 We disagree with Social Services’ characterization that this monthly reconciliation process will create a large workload for the counties. On an ongoing basis, counties are already completing the necessary qualitative reviews to determine whether reports of child abuse meet CACI reporting requirements before sending reports to DOJ. We are simply recommending that the counties reconcile the monthly reports of substantiated child abuse recorded in CWS/CMS against the CACI reports, which the counties already sent to DOJ, to ensure that the counties have sent all eligible reports. 9 We believe Social Services is overstating the potential workload for counties to help ensure that their substantiated child abuse reports are in CACI. Further, we believe counties will focus their attention on the intended consequence of our recommendation, which is ensuring that CACI is accurate and complete so that children are better protected. Finally, our recommended reconciliation process is intended to be a temporary solution until the Legislature amends state law and allows DOJ access to the substantiated reports of child abuse in CWS/CMS data directly. California State Auditor Report 2021-112 67 May 2022 10 Social Services asserts that technical limitations in CWS/CMS may prohibit sharing information directly with DOJ. Additionally, it states that before making technical changes to its system to implement our recommendation, it would have to build a case for a business need to do so. We believe that ensuring child abuse background checks are based on accurate and reliable information is a sufficient business need considering that one of Social Services’ core missions is to protect vulnerable children. Further, if the Legislature amends state law to require all reports of substantiated child abuse to be included in DOJ’s background checks, as discussed on page 3, Social Services would need to make fewer technical changes to CWS/CMS, which could allow Social Services to more quickly provide CWS/CMS access to DOJ. 11 Social Services suggests implementing a data exchange to transfer information to CACI. However, if Social Services were to effectively implement this solution, CACI data would substantially duplicate information in CWS/CMS. This effort to establish a copy of CWS/CMS data would be unnecessary if DOJ were able to access CWS/CMS directly. Further, as we state on page 26, Social Services estimated that it would not begin implementing the data exchange until fall 2023, during which time DOJ would have responded to many child abuse background checks without the benefit of up-to-date information. This delay underscores the importance of Social Services sharing available data with DOJ immediately. 68 California State Auditor Report 2021-112 May 2022 Blank page inserted for reproduction purposes only. California State Auditor Report 2021-112 69 May 2022 70 California State Auditor Report 2021-112 May 2022 California State Auditor Report 2021-112 71 May 2022 * 1 * California State Auditor’s comments appear on page 75. 72 California State Auditor Report 2021-112 May 2022 1 California State Auditor Report 2021-112 73 May 2022 2 74 California State Auditor Report 2021-112 May 2022 Blank page inserted for reproduction purposes only. California State Auditor Report 2021-112 75 May 2022 Comments CALIFORNIA STATE AUDITOR’S COMMENTS ON THE RESPONSE FROM KERN COUNTY To provide clarity and perspective, we are commenting on the response to our audit from Kern County. The numbers below correspond to the numbers we have placed in the margin of the response. 1 Although Kern County claims to have a procedure in place for accurately responding to and tracking reports that DOJ sends back to it for correction, it was unable to provide documentation of this procedure during the audit. Nevertheless, in response to our recommendations, Kern County acknowledges that it plans to update its policies and procedures to describe how it responds to these requests, and that it will develop a system to track these requests. 2 As we discuss on pages 18 and 19, because Kern County determined that it did not perform an active investigation for certain substantiated cases of child abuse, it did not forward these cases to CACI for inclusion in child abuse background checks, as allowed by state law. To address this gap in reporting to CACI, on page 3, we recommend that the Legislature amend state law to require all substantiated cases of child abuse be included in background checks. 76 California State Auditor Report 2021-112 May 2022 Blank page inserted for reproduction purposes only. California State Auditor Report 2021-112 77 May 2022 DEBRA J. BAETZ County of Orange DIRECTOR AN TRAN SOCIAL SERVICES AGENCY CHIEF DEPUTY DIRECTOR 500 N. STATE COLLEGE BLVD. DORTHE LEE ORANGE, CA 92868-1673 DIVISION DIRECTOR (714) 541-7700 ADMINISTRATIVE SERVICES JYOTHI ATLURI DIVISION DIRECTOR ASSISTANCE PROGRAMS May 10, 2022 CHRISTINE SNAPPER DIVISION DIRECTOR Mr. Michael S. Tilden* CHILDREN & FAMILY SERVICES GAIL ARAUJO Acting California State Auditor DIVISION DIRECTOR 621 Capitol Mall, Suite 1200 FAMILY SELF-SUFFICIENCY & ADULT SERVICES Sacramento, California 95814 ANNE H. LIGHT, M.D. MEDICAL DIRECTOR Subject: Report No. 2021-112 – Child Abuse Central Index Dear Mr. Tilden: The County of Orange Social Services Agency (SSA) has received the California State Auditors (CSA) Child Abuse Central Index draft report dated May 31, 2022. The opportunity to review the report and provide a response is appreciated. SSA is committed to delivering quality services that are accessible and responsive to the community. In the spirit of collaboration, we welcome the external evaluation process to make valuable recommendations for system improvement. As a child welfare agency, SSA agrees that the accuracy of agency records and those of the Child Abuse Central Index (CACI) are vitally important. SSA strives to ensure accuracy and has developed and maintained numerous policies and procedures to safeguard data integrity. Even so, the audit found an opportunity for policy and process improvement, and SSA is committed to implementing that recommendation. SSA would like to thank CSA for its work on this audit and for allowing us an opportunity to respond, enabling an avenue with which to improve our practice. Enclosed, please find our response to the audit recommendations. If I can be of further assistance, please don't hesitate to contact me at Debra.Baetz@ssa.ocgov.com or by phone at 714-541-7773. Sincerely, Debra J. Baetz Director County of Orange Social Services Agency * California State Auditor’s comment appears on page 79. 78 California State Auditor Report 2021-112 May 2022 Response to California State Auditors report CSA Recommendation #1: Develop policies to accurately respond to and track reports DOJ sends back for correction. SSA Response: The agency agrees with this recommendation and has already begun discussions to ensure we accurately respond to and track reports DOJ sends back for correction as identified in the audit. We will fulfill the recommendation within the timeline detailed in the report. CSA Recommendation #2: Adopt grievance hearing policies requiring the return of confidential documents when the county provides such evidence to suspects for a grievance hearing. SSA Response: A grievant receives documents by filing a Welfare and Institutions Code 827 “Petition for Access to Juvenile Case File” (aka 827 Petition) with the Orange § County Superior Court. Once approved by the court, SSA then redacts the documents and they are released by the SSA Custodian of Records. As records are acquired through 1 a legal process, SSA does not have the authority to request the return of the documents. SSA will develop a policy should there be any change in how records are obtained. California State Auditor Report 2021-112 79 May 2022 Comment CALIFORNIA STATE AUDITOR’S COMMENT ON THE RESPONSE FROM ORANGE COUNTY To provide clarity and perspective, we are commenting on the response to our audit from Orange County. The number below corresponds to the number we have placed in the margin of the response. 1 Although Orange County directs complainants to use the “827 Petition” process—which is a process to obtain a court order to access juvenile case file information—to obtain evidence relevant to their grievance hearings, neither state regulations governing CACI nor the statutes authorizing the 827 Petition process requires complainants to use this process. Instead, state regulations governing the grievance hearing process require Orange County to provide evidence to complainants upon request. Thus, we stand by our recommendation that Orange County should develop grievance hearing policies that address the return to it of confidential documents that suspects obtain outside of the 827 Petition process. 80 California State Auditor Report 2021-112 May 2022 Blank page inserted for reproduction purposes only. California State Auditor Report 2021-112 81 May 2022 Tuesday, May 10, 2022 Michael S. Tilden, CPA, Acting California State Auditor California State Auditor’s Office 621 Capitol Mall, Ste 1200 Sacramento, CA 95814 Subject: Response to the California State Auditor’s Office regarding Shasta County Child Abuse Central Index Audit (2021-112 – Confidential Draft Audit Report) Dear Mr. Tilden: Thank you for the opportunity to review the draft of the California State Auditor's Audit findings for Shasta County Health and Human Services Agency, Children’s Services Branch. We agree with the recommendations contained in the copy of the redacted report and have already initiated corrective actions on the issues that were brought to our attention during the review process. Our Agency is committed to improving internal practices to ensure the health and safety of the children of Shasta County. We thank your staff for their professionalism and time in performing this review to help strengthen our operations. If you have any questions or require additional information, please have your staff contact me directly. Sincerely, Miguel Rodriguez, MSABA, LCSW Children’s Services Branch Director 1313 Yuba St. Redding, CA 96001 Phone: (530) 225-5885 Fax: (530) 225-5190 Email: marodriguez@co.shasta.ca.us Miguel Rodriguez, MSABA, LCSW, Branch Director “Engaging individuals, families and cowmwmwu.snhitaisetsa thoh psar.onteetct and improve health and wellbeing.” 82 California State Auditor Report 2021-112 May 2022 Blank page inserted for reproduction purposes only. California State Auditor Report 2021-112 83 May 2022