State High-Risk Audit Program

rotiduA etatS ainrofilaC S T I D U A E T A T S F O U A E R U B High Risk: The California State Auditor’s Initial Assessment of High-Risk Issues the State and Select State Agencies Face May 2007 2006-601 The first five copies of each California State Auditor report are free. Additional copies are $3 each, payable by check or money order. You can obtain reports by contacting the Bureau of State Audits at the following address: California State Auditor Bureau of State Audits 555 Capitol Mall, Suite 300 Sacramento, California 95814 (916) 445-0255 or TTY (916) 445-0033 OR This report is also available on the World Wide Web http://www.bsa.ca.gov The California State Auditor is pleased to announce the availability of an on-line subscription service. For information on how to subscribe, please contact the Information Technology Unit at (916) 445-0255, ext. 456, or visit our Web site at www.bsa.ca.gov Alternate format reports available upon request. Permission is granted to reproduce reports. C S A ALIFORNIA TATE UDITOR ELAINE M. HOWLE DOUG CORDINER STATE AUDITOR CHIEF DEPUTY STATE AUDITOR May 31, 2007 2006-601 The Governor of California President pro Tempore of the Senate Speaker of the Assembly State Capitol Sacramento, California 95814 Dear Governor and Legislative Leaders: As authorized by Chapter 251, Statutes of 2004, the Bureau of State Audits presents its report concerning its initial assessment of high-risk issues the State and select state agencies face. Providing the leadership, programs, and services the State needs is a complex business; the use of significant resources and the provision of critical services to the people of California are accompanied by risks. Systematically identifying and addressing high-risk areas can contribute to enhanced efficiency and effectiveness by focusing the State’s resources on improving the delivery of services related to important programs or functions. We believe the State is currently faced with at least five significant statewide risk areas: emergency preparedness, maintaining and improving infrastructure, information technology, management of human resources, and other post-employment benefits of retiring state employees. We further believe that two state agencies meet our criteria for high risk as they face challenges in their day-to-day and long-term operations: the Department of Corrections and Rehabilitation and the Department of Health Services. We will continue to monitor the risks we have identified in this report and the actions state agencies take to address them. In addition, we plan to periodically evaluate the quality and effectiveness of the State’s mitigation efforts by conducting audits and making recommendations for improvement. When the State’s actions, including those in response to our recommendations, result in significant progress toward resolving or mitigating these risks, we will remove the high-risk designation based on our professional judgment. Respectfully submitted, ELAINE M. HOWLE State Auditor BUREAU OF STATE AUDITS 555 Capitol Mall, Suite 300, Sacramento, California 95814 Telephone: (916) 445-0255 Fax: (916) 327-0019 www.bsa.ca.gov ConTenTS Summary 1 Introduction 5 High-Risk Issues the State and Select State Agencies Face Broad Areas of High Risk 7 Removal of Broad Areas of Risk From the High-Risk List 21 State Agencies Facing Risks and Challenges 21 Appendix Considerations for Determining High Risk 33 SuMMArY ReSulTS in BRief Providing the leadership, programs, and services the State needs is a complex business; the use of significant resources Report Highlights . . . and the provision of critical services to the people of Effective January 2005, California are accompanied by risks. Systematically identifying Government Code, and addressing high-risk areas can contribute to enhanced Section 8546.5, authorizes efficiency and effectiveness by focusing the State’s resources the Bureau of State Audits on improving the delivery of services related to important (bureau) to develop a risk assessment process for the programs or functions. Legislation effective in January 2005 State. Through this process, authorizes the Bureau of State Audits (bureau) to develop a risk the bureau will identify, assessment process for the State. In particular, Government audit, and issue reports with recommendations for Code, Section 8546.5, authorizes the bureau to establish a improvement in areas it high-risk audit program to identify, audit, and issue reports with identifies as high risk. recommendations for improvement in areas it identifies as high risk. The bureau’s authority includes initiating audits of areas For this inaugural high-risk identified as high risk and requiring the responsible state agencies list, we have identified both risks that encompass multiple to periodically report on the status of their progress in mitigating state agencies and those or resolving identified risks. that are agency-specific. The following are the significant In some instances risks related to leadership, programs, or statewide risk areas: services cut across all or multiple state agencies; in other  Emergency preparedness instances one or more of these risks are concentrated in one  Maintaining and state agency. For this inaugural high-risk list, we have identified improving infrastructure both risks that encompass multiple state agencies and those that are agency-specific. In particular, we believe the State  Information technology is currently faced with at least five significant statewide risk  Management of human areas: emergency preparedness, maintaining and improving resources infrastructure, information technology (IT), management of  Other post-employment human resources, and other post-employment benefits of retiring benefits of retiring state state employees. We further believe that two state agencies meet employees our criteria for high risk as they face challenges in their day-to-day and long-term operations: the Department of Corrections and The following two state Rehabilitation (Corrections) and the Department of Health agencies meet our criteria for Services (Health Services). high risk:  Department of Corrections California’s emergency preparedness system must address a and Rehabilitation wide range of potential emergencies, some of which can be  Department of Health catastrophic in their effect on public health, safety, and economic Services well-being. Multiple state agencies play a role in ensuring the State is prepared to respond to emergencies including the Governor’s Office of Homeland Security, the Governor’s Office of California State Auditor Report 2006-601 1 Emergency Services, and Health Services. Despite the heightened awareness of the potential for a catastrophic emergency arising from events such as Hurricane Katrina and the terrorist attacks on the United States in 2001, the State is not as well prepared for emergencies as it should be. The bureau’s most recent report on emergency preparedness supports this concern. Among the key concerns the bureau noted in that report were that the State’s organizational structure for ensuring emergency preparedness is neither streamlined nor well-defined and its annual response exercises have not sufficiently tested the medical and health response systems. Infrastructure is the underlying foundation or basic framework of a system or organization. The State’s infrastructure covers a myriad of assets including roads, bridges, and levees, much of which was constructed in the 1950s and 1960s. Maintenance and improvement needs for these critical State assets have increased as they have aged but have not always been met. Similarly, as the State’s population has grown, it is widely acknowledged that we have not always added the infrastructure necessary to accommodate that growth. Until recently, significant financing has not been available to meet infrastructure demands. However, in November 2006 the voters approved an unprecedented bond package totaling $42.7 billion to begin addressing the State’s infrastructure needs. The authorization of these bond funds introduces a number of risks that must be addressed. The State must properly plan for the use of these bonds, coordinate the projects the funds will finance, take on debt responsibly, and ensure it meets its fiduciary responsibility to the taxpayers by monitoring and overseeing how these dollars are spent. Information technology (IT) systems are increasingly important for efficient and effective business practices. Strong IT oversight is critical at a time when the State has IT projects in process which, according to the Department of Finance, currently total nearly $6 billion. However, despite efforts to establish statewide governance over IT, the State’s prior models had limited success and did not provide the statewide vision needed to ensure the State invests in IT projects promising the greatest possible benefit. As a result, the State has suffered past IT failures costing taxpayers hundreds of millions of dollars. The State is beginning to implement a new governance model, but the functions of and full level of responsibility for the current model are not 2 California State Auditor Report 2006-601 yet clear. Without strong statewide oversight and a clear vision of IT needs, the State is at risk for ineffective and improper IT investment and use. Human resources management is another statewide high-risk area. The State will soon face the consequences of a significant portion of its current workforce retiring. According to the Department of Personnel Administration, 44 percent of the State’s current workforce is over the age of 45, and up to 35 percent of these employees are eligible to retire between 2006 and 2010. Staffing shortfalls may reduce the ability of state agencies to perform their missions efficiently and effectively, and significant vacancies could threaten the ability of state programs to deliver critical services. Large numbers of retirements and filling vacancies with quality staff present challenges that are strongly entrenched and far-reaching. These challenges are not limited to any one agency; they have the potential to negatively impact every state agency. As more and more top managers and key staff reach retirement age, this challenge will become more acute. Another effect of these retirements is the increased cost to the State of other post-employment benefits—those benefits the State pays individuals in addition to a pension, such as health care. The State pays 100 percent of the health insurance cost for retirees, as well as certain other costs, out of annual appropriations on a pay-as-you-go basis. The cost of providing these insurance benefits to retirees for the year ended June 30, 2006, was $888 million. With the required implementation of a new federal reporting standard, the State’s financial statements for fiscal year 2007–08 will for the first time need to reflect its estimated liability for these future other post-employment benefits. In early May 2007 the State Controller’s Office issued a report from its actuary estimating the liability at $48 billion as of July 1, 2007. The State’s risk here is twofold: whether it can afford to provide the level of benefits promised to its employees while protecting its credit rating. Bond rating agencies have already made it clear they will look with disfavor on governments that do not adequately plan for managing this liability. Although we do not intend them as a complete list of all the risks state agencies face, Corrections and Health Services presently face significant challenges that warrant inclusion on our inaugural high-risk list. Corrections reports that many of its adult institutions are exceeding their capacity to safely house California State Auditor Report 2006-601  and rehabilitate inmates and the United States District Court for the Northern District of California placed Corrections’ inmate health care system in receivership. Corrections also faces the challenge of continuing to implement a reorganization it began in 2005, a reorganization designed to address many of the problems it faced then and continues to face today. Corrections’ reorganization efforts are also at risk because of inconsistent leadership at many management levels. On July 1, 2007, Health Services is slated to split into two separate departments: the Department of Public Health and the Department of Health Care Services. The primary goal for the split is to provide stronger, more focused leadership over public health and to give the State’s role in public health a significantly higher priority. The Legislature has also expressed its expectation for increased accountability and program effectiveness for both the public health and health care purchasing functions the State provides. California faces risks related to program continuity from creating two departments where just one existed before, and the two new departments face challenges of enhancing accountability and program effectiveness to meet the Legislature’s expectations. We will continue to monitor the risks we have identified in this report and the actions state agencies take to address them. To successfully mitigate these risks, we believe the State needs to take certain actions. For example, in the case of the broad areas of risk involving multiple agencies a responsible person, group, or entity must be charged to address the risks. Those responsible parties and the specific state agencies we have designated as being at high risk must demonstrate a commitment to address the risks and have sufficient resources to resolve them. They must develop detailed and definitive action plans along with a process for independently monitoring and measuring the effectiveness of the steps taken. In addition to monitoring these actions, we plan to periodically evaluate the quality and effectiveness of the State’s mitigation efforts by conducting audits and making recommendations for improvement. When state actions, including those in response to our recommendations, result in significant progress toward resolving or mitigating these risks, we will remove the high-risk designation based on our professional judgment. n  California State Auditor Report 2006-601 InTroduCTIon BACkgRound Identifying and addressing high-risk areas in California’s government can lead to the assessment and resolution of serious weaknesses in the State’s use of significant resources and provision of critical services to its citizens. The process of systematically identifying and addressing high-risk areas can also contribute to enhanced efficiency and effectiveness, focusing the State’s resources on improving the delivery of services related to important programs and functions. High-risk programs and functions include not only those particularly vulnerable to fraud, waste, abuse, and mismanagement or that present major challenges associated with their economy, efficiency, or effectiveness, but also those of particular interest to the citizens of the State and those that have potentially significant impacts on public health, safety, and economic well-being. fedeRAl And STATe RiSk ASSeSSmenT PRogRAmS Since 1990 the U.S. Government Accountability Office has periodically reported on federal government operations that it has designated as high risk, identifying general and specific areas of concern, making recommendations to address weaknesses, and performing follow-up assessments of progress made in resolving issues. Some of the areas of concern it has identified—management of contracts and human resources, for example—are responsibilities all governments share. Others, such as the functions of the Federal Aviation Administration or the Department of Defense, relate primarily to federal responsibilities. Legislation effective in January 2005 authorizes the Bureau of State Audits (bureau) to develop a similar risk assessment process for the State. In particular, Senate Bill 1437 of the 2003–04 Regular Session of the Legislature added Section 8546.5 to the Government Code. It authorizes the bureau to establish a high-risk audit program, to issue reports with recommendations for improvement in areas it identifies as high risk, and to require state agencies responsible for these identified programs or functions to report periodically to the bureau on the status of recommendations for improvement made by the bureau. California State Auditor Report 2006-601  The BuReAu’S CRiTeRiA foR idenTifying AReAS of high RiSk Our first task was to formulate considerations for developing an initial list of statewide issues and state agencies that we believe are at high risk for the potential of waste, fraud, abuse, and mismanagement or that have major challenges associated with their economy, efficiency, or effectiveness. In the Appendix we describe the factors we considered including: an agency’s mission or key function and how it contributes to the State’s overall performance, qualitative and quantitative factors, an agency’s responsiveness to recommendations, and the quality of corrective measures. We also outline in the Appendix the factors we will consider in determining whether it is appropriate to remove a statewide issue or state agency from our high-risk list. SCoPe And meThodology Government Code, Section 8546.5, authorizes the bureau to establish an audit program for identifying state agencies that are at high risk for potential waste, fraud, abuse, and mismanagement or that have major challenges associated with their economy, efficiency, or effectiveness. The law also authorizes the bureau to audit any state agency that it identifies as high risk and to issue related audit reports at least once every two years. This report provides an initial list of high-risk areas the bureau identified, which may be the subject of audits we perform in the future. To identify high-risk areas in state government, we established criteria for identifying areas of high risk, as previously described. We reviewed audit and investigative reports we have issued to identify issues of significant concern and reviewed reports of other audit or oversight entities. In addition, we consulted with legislative budget and fiscal committees, the Legislative Analyst’s Office, the Milton Marks “Little Hoover” Commission on California State Government Organization and Economy, the Department of Finance, and other control agencies that have oversight responsibilities in the State. For those areas we concluded on a preliminary basis to be high risk, we interviewed agencies with significant related responsibilities to assess their perspectives on the extent of risk the State faces and to identify any efforts underway to mitigate the risks. We also reviewed reports and other documentation they provided to us. 6 California State Auditor Report 2006-601 HIgH-rISk ISSueS THe STATe And SeleCT STATe AgenCIeS FACe BRoAd AReAS of high RiSk California has a large and diverse economy and is home to more than 37 million people. Providing the leadership, programs, and services the State needs is a complex business with risks related to the use of significant resources and the provision of critical services to the people of California. In some instances risks concerning leadership, programs, or services cut across all or multiple state agencies; in other instances, one or more of these risks are concentrated in one agency. In this inaugural high-risk list we have identified risks that cut across multiple state agencies and those that are agency-specific as the Appendix describes in greater detail. We believe the State is currently faced with at least five significant statewide risk areas: emergency preparedness, maintaining and improving infrastructure, information technology, management of human resources, and other post-employment benefits of retiring state employees. emergency Preparedness California’s emergency preparedness system, which links the State in mutual-assistance agreements with local governments and federal emergency preparedness agencies, must address a wide range of potential emergencies, some of which can be catastrophic in their effect on public health, safety, and economic well-being. Potential emergencies range from single, short-term events, such as the major earthquakes and fires in densely populated areas California has experienced in the past, to prolonged emergencies like a pandemic that the medical community has warned could sweep the State, last for months, and challenge the capacity of hospitals and clinics to accommodate the sick. In addition to natural disasters, the State must be prepared for man-made events—like the terrorist attacks in September 2001 or the riots that caused extensive damage in Los Angeles in 1992. In California, although about 40 state entities may be involved when the State responds to emergencies, the following three are very heavily involved in preparedness: the Governor’s Office of California State Auditor Report 2006-601  Homeland Security (State Homeland Security), the Governor’s Office of Emergency Services (Emergency Services), and the Department of Health Services (Health Services). State Homeland Security serves as the lead state contact with Federal Homeland Security on matters relating to terrorism and state security and develops, implements, and maintains a statewide homeland security strategy. Emergency Services is the lead agency for emergency management in California and coordinates the State’s response to major emergencies in support of local entities. Health Services coordinates the State’s overall public health preparedness and response efforts and maintains California’s public health emergency plans. Despite the heightened awareness of the potential for a catastrophic emergency such as the devastation caused from Hurricane Katrina and the terrorist attacks on the United States in 2001, the State is not as well-prepared for emergencies as it should be. Since 2002 the bureau has issued five reports related to emergency preparedness. Each report concludes that the State is weak in one or more of the four elements of emergency preparedness: planning, training, The bureau’s five reports on emergency corrective action, and equipment and resources. preparedness since 2002 highlight the State’s weakness in one or more of the four elements of emergency preparedness: planning, training, The planning phase of emergency preparedness is corrective action, and equipment and resources. to prepare or undertake activities in advance of an The bureau’s five reports are titled as follows: emergency to be ready should an emergency occur. • Emergency Preparedness: California’s However, in four of the five reports we have issued Administration of Federal Grants for Homeland Security and Bioterrorism Preparedness Is since 2002 on this subject, the bureau expressed Hampered by Inefficiencies and Ambiguity concerns with the State’s planning. For example, (Report 2005-118, September 2006) in a July 2003 report (report 2002-113), the bureau • Emergency Preparedness: More Needs to Be noted that Emergency Services lacked a formal Done to Improve California’s Preparedness for Responding to Infectious Disease Emergencies process to regularly review and update the State (Report 2004-133, August 2005) Emergency Plan and its annexes including the • Governor’s Office of Emergency Services: Its Earthquake Advisory Plan and Emergency Resources Oversight of the State’s Emergency Plans and Management Plan. Also, three of our reports noted Procedures Needs Improvement While Its Future Ability to Respond to Emergencies May Be issues regarding training. For instance, in a report Hampered by Aging Equipment and Funding focused on terrorism readiness (report 2002-117) Concerns (Report 2002-113, July 2003) the bureau concluded that the California National • Terrorism Readiness: The Office of Homeland Guard had not provided all of the training its Joint Security, Governor’s Office of Emergency Services, and California National Guard Need to Improve Operations Center needed to adequately respond to Their Readiness to Address Terrorism terrorism missions. (Report 2002-117, July 2003) • California National Guard: To Better Respond to The bureau issued its most recent report on State Emergencies and Disasters, It Can Improve Its Aviation Maintenance and Its Processes of emergency preparedness in September 2006. In this Preparing for and Assessing State Missions report, the bureau noted four principal concerns: (Report 2001-111.2, February 2002) The State’s organizational structure for ensuring  California State Auditor Report 2006-601 emergency preparedness is neither streamlined nor well-defined; its annual response exercises have not sufficiently tested the medical and health response systems; Emergency Services and State Homeland Security have been slow in spending federal grant awards for improving homeland security; and Emergency Services is behind schedule in its receipt and review of county and state agency emergency operations plans. When we solicited their perspectives on emergency preparedness, Emergency Services and Health Services both pointed to their respective strengths and weaknesses in preparing for emergencies that require their response. Positive trends Emergency Services noted included the State’s efforts to implement systems to foster better-integrated communications among emergency responders and to address the concerns of populations with special needs by including representatives of these communities in Standardized Emergency Management Systems (SEMS) committees. SEMS is the system California uses to manage its responses to emergencies. In contrast, Emergency Services also listed numerous areas of concern, including inadequate salaries for the emergency management workforce, limited resources for equipment, and insufficient efforts to make the public aware of the risks posed by emergencies. Health Services pointed out that the evolution of its Emergency Preparedness Office from a small unit several years ago to an equal partner with the other major divisions of the department underscores the increased attention and recognition it has given to emergency preparedness. However, Health Services also believes that there is currently a lack of agreement on goals between the federal and state governments, accompanied by a shift in focus from terrorism to natural disasters prompted by Hurricane Katrina. An official we contacted at State Homeland Security spoke extensively on preparedness in terms of its metrics project. According to State Homeland Security, the federal National Response Plan poses 15 scenarios that the State wants to be prepared for. State Homeland Security is working with Emergency Services and local working groups to determine from the ground up what capabilities exist and to set a metric for a minimum level of preparedness for each type of emergency scenario. California State Auditor Report 2006-601  maintaining and improving infrastructure Infrastructure is the underlying foundation, or basic framework of a system or organization. The State’s infrastructure covers a myriad of assets including roads, bridges, levees, housing, schools, government buildings, prisons, parks, and health facilities. Much of the State’s infrastructure was constructed in the 1950s and 1960s. As these critical assets have aged, maintenance needs have increased but have not always been met. For example, the State estimated that $2 billion would be needed to preserve the existing state highway system for the fiscal year ending June 30, 2006, but only $1.5 billion was actually spent during that year. In addition, the number of state highway lane miles in fair to poor condition has been increasing in recent years, with the total reaching more than 13,800 miles as of June 2006. Similarly, it is widely acknowledged that we have not always added the infrastructure necessary to accommodate the State’s population growth. As a result, significant investments will be needed to upgrade and expand the State’s infrastructure. Until recently, significant financing has not been available to meet infrastructure needs. However, in November 2006 the voters approved an unprecedented bond package totaling $42.7 billion to begin addressing the State’s infrastructure needs. The authorization of these bond funds introduces a number of risks that the State will need to address. In particular, the State must properly plan its use of these bond funds and coordinate the projects the funds will finance so that it follows the voters’ intent and the bond funds are effectively and efficiently used. In addition, taking on debt creates its own risk, and the State must do so responsibly. Finally, the State has a fiduciary responsibility to the taxpayers to monitor and oversee how these dollars are spent. Planning and Coordination The following bureau reports highlight the In January 2007 the governor released the importance of timely and cost-effective project delivery: California Strategic Growth Plan, which indicates • California Department of Transportation: Low that California requires over $500 billion in Cash Balances Threaten the Department’s Ability infrastructure investment to meet the demands to Promptly Deliver Planned Transportation of its growing population over the next 20 years. Projects (Report 2002-126, July 2003) The 2006 bond package represents a portion • California Department of Transportation: Seismic Retrofit Costs of State-Owned Toll Bridges of the money with which the State can begin Have Significantly Exceeded the Department’s to address its infrastructure needs. However, Original Estimates and May Go Even Higher addressing these needs will take large-scale (Report 2001-122, August 2002) planning and coordination. For example, one 10 California State Auditor Report 2006-601 of the bond measures voters approved was the Safe Drinking Water, Water Quality and Supply, Flood Control, River and Coastal Protection Bond Act of 2006. This measure authorized $5.4 billion in bond funds to be distributed to or administered by 20 different state departments and boards and local conservancies, including the Departments of Water Resources and Parks and Recreation, the State Water Resources Control Board, and a variety of coastal, mountain, and river conservancies. According to an analysis the Legislative Analyst’s Office (Analyst’s Office) performed, there are 67 pots of money included in the 2006 bond package, each with its own purpose and administering agency. The bonds also fund 21 new state programs. In the 2007 California Five-Year Infrastructure Plan (infrastructure plan), the Department of Finance (Finance) describes the 2006 bonds as the first installment in the governor’s 20-year plan to rebuild California. The infrastructure plan acknowledges the importance of planning and prioritizing. However, considering the breadth of the State’s needs, the numerous categories of infrastructure the 2006 bond package is authorized to fund, and the number of administering agencies, the State faces risks. Such risks include ensuring that it properly prioritizes its infrastructure projects, then selects and executes those most likely to meet existing and future needs. The State also faces risks in ensuring that the various agencies with a role in expending the bond funds coordinate as needed and that redundancy and confusion do not result in wasted time and money and needless delays in completing critical projects. Managing Debt The 2006 bond package authorized the State to issue $42.7 billion in general obligation bonds. The State, in planning to finance a large part of its infrastructure with bond funds, faces the challenge of financing the right projects and balancing this debt with other potentially necessary debt. Bonds are generally paid back over a long period of time. It is appropriate to use bond proceeds for financing infrastructure because the long repayment period often mirrors the life of the infrastructure and spreads the financing costs to the many people who benefit from the projects. However, the State must be vigilant to ensure that the terms of future bond issuances responsibly spread costs over the life of the infrastructure projects they are used to create or improve. California State Auditor Report 2006-601 11 Another challenge with funding infrastructure with bond funds is balancing additional debt with existing or other potentially necessary debt. The State issues bonds for a variety of reasons and at any point in time has a number of bonds outstanding. However, it must be sensitive to its debt burden. As the infrastructure plan notes, the bond markets and bond rating agencies are watchful of the reasonableness of a state’s debt level. A common measure of a state’s debt burden is the ratio of General Fund debt service payments to state revenues referred to as the debt-service ratio. According to the Analyst’s Office, some in the investment community look to the debt-service ratio as a useful general indicator of the State’s debt burden, and some have expressed concerns when the ratio starts to exceed 6 percent. The Analyst’s Office also indicated that the debt-service ratio for fiscal year 2005–06 amounted to 5.4 percent. It will be important for the State to continue monitoring its debt burden to ensure it can arrange future borrowings at reasonable interest rates. Although the voters approved a significant investment in the State’s infrastructure through the 2006 bond package, the State will need to be efficient to ensure all the spending authority is put to good use. For example, the Highway Safety, Traffic Reduction, Air Quality and Port Security Bond Act of 2006 provides for $4.5 billion in bond funds for performance improvements on California’s highly congested travel corridors. The act also specifies that a project can only be included in the program if construction or implementation commences no later than December 31, 2012. In commenting on the risks the State faces related to infrastructure, an official from the Department of Water Resources told us that for the work needed on the State’s levees and water systems, it will be challenging to meet certain time requirements because of the lengthy efforts currently underway that are necessary to measure where the needs are greatest. However, he also noted that there are a number of local projects that are ready to get underway and that the bond funds will allow them to start soon. Oversight Infrastructure may be planned and built by the State, but it is funded with taxpayer money. Therefore, the State has a fiduciary responsibility to monitor and oversee how these dollars are spent. The 2006 bond package offers a mixed bag in terms of its requirements to report on or audit the use of the funds. For example, according to the Analyst’s Office, transportation 12 California State Auditor Report 2006-601 represents the largest segment of the bond funding at $19.9 billion, and this money will fund The following bureau reports highlight weaknesses in oversight of state and local 15 different programs. However, only nine of the infrastructure projects: programs require oversight reports or audits. • Department of Parks and Recreation: It Needs to Improve Its Monitoring of Local Grants In January 2007 the governor issued an executive and Better Justify Its Administrative Charges (Report 2004-138, April 2005) order laying a framework for bond accountability. • Department of Transportation: Various Factors The order states that “departments shall be Increased Its Cost Estimates for Toll Bridge accountable for ensuring that bond proceeds Retrofits, and Its Program Management Needs are spent efficiently, effectively and in the best Improving (Report 2004-140, December 2004) interests of the people of the State of California.” The order requires each department to establish a three part accountability structure for the bond proceeds they may receive. The first part of the accountability structure requires departments to follow existing criteria for bond expenditures including state or federal law, regulations, implementation plans, or a capital outlay program. The second part of the structure requires these departments to document ongoing actions to ensure projects funded with the bonds stay within their scopes and budgeted costs and for each administering department to report about its actions semi-annually to Finance. The third point of accountability makes department expenditures funded with bond proceeds subject to audit by Finance. We discussed infrastructure with staff from the California Transportation Commission (Transportation Commission). According to the Transportation Commission’s executive director, a challenge the State faces is ensuring that the projects undertaken are delivered, especially at the local level. Projects must be completed and opened to users in a timely manner to offer the intended benefits. Because construction costs can rise rapidly, timely project completion also helps to ensure available funding is maximized. The Transportation Commission told us it is planning to provide stronger oversight on transportation projects undertaken as part of the 2006 bond package to ensure that once funds are committed, the projects move forward rapidly to completion. Given the size, complexity, and cost of the State’s infrastructure needs and the public funds made available to address them, oversight will be critical to ensuring the programs are run efficiently and effectively and provide maximum benefit. California State Auditor Report 2006-601 1 information Technology Information technology (IT) systems are increasingly important for efficient and effective business practices. The State has an ongoing need for its IT to keep pace with technology changes and to develop and use IT where it has not existed in the past. However, despite efforts to establish statewide governance, the State has lacked strong IT oversight for many years. Its prior governance models have had limited success and have not provided the statewide vision needed to ensure the State invests in IT projects with the greatest possible benefit. Moreover, the functions of and full level of responsibility for the current governance model are not yet clear. Without strong statewide oversight and a clear vision of its IT needs, the State is at risk for ineffective and improper IT investment and use. Strong oversight is critical at a time when the State has IT projects planned or in process that, according to Finance, total nearly $6 billion. In 1995 Senate Bill 1 (Chapter 508, Statutes of 1995) established the Department of Information Technology (DOIT). The Legislature created DOIT largely in response to a number of costly and embarrassing problems with implementing various IT projects—most notably, the Department of Motor Vehicles database redevelopment project that cost the State $49 million, but did not result in a working system. DOIT was created to improve the State’s ability to apply IT effectively by providing leadership, guidance, and oversight for projects initiated by state agencies. However, DOIT was not successful in its mission, and on July 1, 2002, the Legislature disbanded it. A 2003 report by the bureau provided insight into several of DOIT’s struggles. For example, DOIT’s The bureau’s 2003 report, titled Information ability to plan IT projects was hampered by its Technology: Control Structures Are Only Part need to balance advocacy and control and build of Successful Governance (Report 2002-111), highlighted DOIT’s challenges. trust with agency staff. In addition, the bureau The bureau has also reported on IT leadership and reported that DOIT had no clearly defined approval contracting issues in these two reports: role or responsibilities. Both DOIT and Finance had • Enterprise Licensing Agreement: The State Failed a role in the approval process, but their individual to Exercise Due Diligence When Contracting With roles were not clear. In principle, DOIT would Oracle, Potentially Costing Taxpayers Millions of Dollars (Report 2001-128, April 2002) review the merit of the technology of a proposed IT project; Finance would review the business case • Information Technology: The State Needs to Improve the Leadership and Management and approve funding, relying on DOIT’s technical of Its Information Technology Efforts expertise. In practice, however, DOIT became (Report 2000-118, June 2001) primarily a rubber‑stamp department, while Finance made the final decisions about IT projects because it had control over funding approval. State agencies 1 California State Auditor Report 2006-601 saw Finance’s and DOIT’s roles as overlapping, and this ambiguity and the imbalance of power eroded the agencies’ trust and confidence in these two control entities. Following DOIT’s closure, the former governor appointed a new chief information officer.1 However, the chief information officer had limited staff support and no statutory authority or budget. At the same time the former governor used an executive order to restructure the State’s IT governance, giving Finance and the Department of General Services collective responsibility for issuing management memoranda to provide continuity and clarity with respect to statewide IT policies, procedures, approvals, and oversight. In addition, state agencies were charged with the prudent oversight of ongoing IT projects and procurements within their jurisdictions. There have been failed projects costing taxpayers hundreds of millions of dollars under these past governing structures. In 1997, after spending more than $111 million, the State abandoned development of a system to establish a statewide automated network for tracking child support payments. A new statewide system is being implemented in two phases. According to the chief information officer, phase one is operational and phase two, which was started in 2006, is scheduled for full implementation by September 2008. The delays in implementing this system have cost the State hundreds of millions of dollars in federal penalties. Other major project failures, including those at the Department of Motor Vehicles and the Department of Corrections and Rehabilitation, have cost the State and taxpayers about $400 million. More recently, in November 2006, the State abandoned a $10 million investment in the California Developmental Disabilities Information System. This IT system was intended to improve the statewide tracking of expenditures and services for the developmentally disabled. According to the chief information officer, the project was abandoned when it became clear that the State could not satisfy all the requirements for project continuation and the decision to abandon it likely avoided an additional $30 million to $50 million in costs. In 2006 the Legislature passed and the governor signed into law Senate Bill 834 (Chapter 533, Statutes of 2006), creating the Office of the State Chief Information Officer (State CIO), to be headed by a chief information officer, a cabinet-level position. As of May 25, 2007, no one has been appointed to fill the 1 This individual is continuing to work in this capacity under the current administration. California State Auditor Report 2006-601 1 position. Among its key duties, this office is charged with advising the governor on the strategic management and direction of the State’s IT resources and promoting effective and efficient use of IT systems by minimizing overlap, redundancy, and cost. According to the chief information officer this statute largely codified his existing responsibilities. The 2007–08 Governor’s Budget lays out an aggressive agenda for the State CIO and proposes to expand this office’s role. However, the State may be poised to repeat past mistakes in adopting the proposal. According to the Analyst’s Office in its Analysis of the 2007–08 Governor’s Budget, the State CIO would have no authority to fund projects; this authority would remain with Finance. The Analyst’s Office noted that a state agency could end up with a State CIO-approved project and still be denied funding by Finance. In fact, the Analyst’s Office further noted this was one of the problems that contributed to DOIT’s failure. Finance often funded projects below the level recommended by DOIT, which over time diminished DOIT’s role because it had no financial clout to support its decisions. The Analyst’s Office’s budget analysis also noted that the budget lists 15 major IT goals but has not prioritized them. The Analyst’s Office is concerned that such an aggressive agenda will result in reduced effectiveness, the same problem that plagued DOIT during its existence. According to the bureau’s previously referenced IT report, one of the reasons for DOIT’s lack of success was that it attempted to tackle too many challenges at once rather than establish a set of priorities and take on only the most important issues, as time and resources permitted. In light of these continuing concerns and with several costly and complex projects planned or currently underway, the State has a critical need for strong IT governance. For example, the Franchise Tax Board’s California Child Support Automated System is projected to cost $1.6 billion through fiscal year 2008–09, and the Department of Corrections and Rehabilitation’s Strategic Offender Management System is projected to cost $416 million through fiscal year 2012–13. The most extensive and long- term project the administration has recently proposed is the Financial Information System for California (FI$Cal), which Finance has projected to cost $1.3 billion through fiscal year 2014–15. The California State Information Technology Annual Report for 2006 notes that the resources necessary to design and implement the project still need to be obtained through the 16 California State Auditor Report 2006-601 budget process. According to the chief information officer (if the Legislature approves the project by funding it) FI$Cal will be an enterprise-wide business management system that will become the mandatory standard for all state agencies for performing basic business functions, such as budgeting, accounting, procurement, cash management, financial management, and financial reporting. Because the proposed scope and cost of this and other previously discussed projects are significant, effective governance over development and implementation of these projects is critical. human Resources management The State will soon face the consequences resulting from the retirement of a significant portion of its current workforce, including many of its top managers and key staff. As a result, human resources management is another statewide high- risk area because any large exodus of experienced employees could reduce the ability of state agencies to perform their core missions efficiently and effectively, and could threaten the ability of state programs to deliver critical services. As large numbers of its workforce reach retirement age, the State will be further challenged by its ability to recruit and train enough employees to fill the vacated positions. According to the Department of Personnel Administration’s (Personnel Administration) Workforce Planning Model, dated February 2006, 44 percent of the State’s current workforce is over the age of 45 and up to 35 percent of this segment are eligible to retire between 2006 and 2010. The loss of experienced, long-term employees is often keenly felt because they take with them their accumulated institutional knowledge and expertise. However, the sheer number of retirement-aged staff who now occupy supervisory and management-level positions but who will soon be leaving the workforce poses a grave risk that the State will not be ready to replace them when the time comes. The large number of experienced employees who will retire soon and the urgent need to quickly recruit and train new employees having the appropriate skill sets to take their place is a problem that faces virtually all state agencies. As more and more high-level managers reach retirement age, it exposes those agencies that have failed to adequately plan for succession, as they have no ready means for replacing the loss in leadership with trained high-quality employees—creating a serious risk in terms of delivering key services. California State Auditor Report 2006-601 1 Part of the challenge state agencies face in recruiting is caused by the State’s rules for hiring employees. It is very difficult for individuals who do not already work for the State to get into entry-level positions, such as those in the staff services analyst series, and it is virtually impossible at the managerial level. These were two conclusions the Milton Marks “Little Hoover” Commission on California State Government Organization and Economy (Little Hoover Commission) reached in its June 2005 report on managing the state workforce, which was primarily focused on recruiting and retaining top talent at the managerial level. When compared with the private sector, the State’s capacity to recruit, train, and retain certain staff is limited due to its lengthy hiring process and noncompetitive salaries. These difficulties limit the State’s ability to attract top talent from colleges and universities, as well as to lure employees from the private sector. Although each state agency typically screens, interviews, and hires its own employees, two agencies within the state structure are responsible for setting policies and overseeing a variety of broad personnel issues: the State Personnel Board (Personnel Board), and Personnel Administration. The Personnel Board is responsible for California’s civil service system; it ensures that the system is free from political patronage and that employment decisions are based on merit. State agencies can obtain a variety of services from the Personnel Board, including assistance with recruitment, candidate selection, classification, and training and consultation services. Personnel Administration creates and administers compensation levels, benefit packages, training programs, and the State’s classification plan; it also represents the State in negotiating labor contracts with various state employee labor unions. California has recently taken initial, yet important, steps to address employee recruitment, hiring, and retention. In February 2006 the director of Personnel Administration announced the creation of a workforce planning model for the State based on models the federal government and other states and jurisdictions have developed. For example, the U.S. Government Accountability Office has created a human capital resource self-assessment checklist to help agency leaders understand the strengths and weaknesses of the human resources information they have and has created a model for strategic management of human capital. In addition, the Personnel Board periodically offers state agencies an introductory, one-day class in workforce planning. Among other 1 California State Auditor Report 2006-601 subjects, the class focuses on understanding the basic principles of workforce planning, identifying common deterrents to effective planning, introducing several different planning models and helping agencies determine which model best suits their particular needs, and identifying and using the resources to create and maintain a successful workforce plan. Managing ongoing programs faced with a large number of staff retirements will require the State to adequately prepare for leadership continuity and engage in succession planning. Beyond its model on workforce planning, Personnel Administration has provided little direction to state agencies in terms of succession planning. Personnel Administration defines succession planning as a subset of workforce planning that focuses on having the right leadership in place at every level of an organization. This definition appears reasonable, yet in its workforce planning model, Personnel Administration simply refers the user to a report on the Internet for additional information. We believe this falls far short of what is needed to attract, train, and retain tomorrow’s government leaders. other Post-employment Benefits of Retiring State employees Another effect of the large number of retiring employees will be the increased cost to the State of providing them other post-employment benefits. Other post-employment benefits refer to benefits in addition to a pension, such as health care. The State generally pays 100 percent of the health insurance cost for retirees, as well as 90 percent of premiums required for the enrollment of retirees’ family members, and generally pays all or a portion of the dental insurance costs for retirees. The State has not set aside reserves for these costs, instead paying for them out of annual appropriations on a pay-as-you-go basis. The cost of these insurance benefits for the year ended June 30, 2006, was $888 million for 131,000 individuals enrolled to receive health benefits and 106,400 individuals enrolled to receive dental benefits. These numbers are up from $409 million as of June 2001, when 110,000 received health benefits and 89,000 received dental benefits. With the expected increase in the number of state retirees and continuing escalation of health care costs, the State can anticipate a related increase in these annual costs. In addition, with the required implementation of a new financial reporting standard, Statement 45 of the Governmental Accounting Standards Board (GASB 45), beginning with its financial California State Auditor Report 2006-601 1 statements for the year ended June 30, 2008, the State will need to reflect its estimated liability for these future payments of other post-employment benefits. In a February 2006 report the Analyst’s Office estimated that these liabilities are likely to be in the range of $40 billion to $70 billion. In early May 2007 the State Controller’s Office (Controller’s Office) published the results of the first actuarial study to estimate this liability. According to the actuary, the State’s liability for its other post-employment benefits under the pay-as-you-go policy is about $48 billion as of July 1, 2007. Based on this liability, California has an annual required contribution of about $3.6 billion, the amount the State would need to pay yearly to fund these estimated future benefits. According to the Controller’s Office, the State plans to include an actuarial computation of its liability for other post-employment benefits in the fiscal year 2007–08 financial statements. The Controller’s Office also indicated that it has been meeting with various agencies to help educate them about the State’s liability. The governor, too, has taken steps towards understanding the magnitude of the State’s liability by creating the Public Employee Post-Employment Benefits Commission to examine what is owed in unfunded retirement benefits, both pension and nonpension benefits like health care, and to recommend how best to meet those obligations as they come due. With California’s other post-employment benefits liability estimated at $48 billion on an actuarial basis, the risk to the State is at least twofold: determining whether it can afford the level of benefits promised to its employees while at the same time protecting its credit rating. Reporting other post-employment benefits information in accordance with GASB 45 will, among other things, provide financial statement users with information useful in assessing potential demands on the State’s future cash flows. Bond rating agencies have already made it clear that they will look with disfavor on governments that do not adequately plan for managing this liability. To protect its credit rating and ensure that it can borrow at the lowest available interest rates, the State will need to demonstrate that it is adequately managing the long-term costs of its other post-employment benefits. 20 California State Auditor Report 2006-601 RemovAl of BRoAd AReAS of RiSk fRom The high-RiSk liST As the State moves forward to address and mitigate the broad areas of risk the bureau has identified, we will be monitoring to determine if certain actions have been taken as outlined in our criteria in the Appendix. For example, the bureau will determine if a responsible person, group, or entity has been charged with monitoring these risks and has demonstrated a commitment to address them by devoting sufficient resources to mitigate or resolve each identified risk. Another key step the responsible party must take for the bureau to remove a high-risk designation is to develop detailed and definitive action plans along with a process for independently monitoring and measuring the effectiveness of the actions taken. In addition to reviewing these actions, we plan to periodically evaluate the quality and effectiveness of the State’s mitigation efforts by conducting audits and making recommendations for improvement. When state actions, including those in response to our recommendations, result in significant progress toward resolving or mitigating these risks, we will remove the high-risk designation based on our professional judgment. STATe AgenCieS fACing RiSkS And ChAllengeS Although this inaugural report is not intended to be a complete list of all the risks and challenges state agencies face, we believe two state entities, the Department of Corrections and Rehabilitation (Corrections) and the Department of Health Services (Health Services), presently face significant challenges that warrant inclusion on our inaugural high-risk list. In particular, Corrections faces a myriad of challenges. Currently, many of its adult institutions exceed their capacity to safely house and rehabilitate inmates and its inmate health care system is under federal receivership. In addition, Corrections continues to implement a reorganization it began in 2005, a reorganization designed to address many of the problems it faced then and still faces today. Corrections’ reorganization efforts are also at risk because of inconsistent leadership at many levels of management. Health Services is the other department we have included on our inaugural list. On July 1, 2007, it is slated to split into two separate departments, the Department of Public Health and the Department of Health Care Services, to provide stronger, more focused leadership in public health and to give the State’s role in public health a significantly higher priority. The Legislature has California State Auditor Report 2006-601 21 also expressed its expectation for increased accountability and program effectiveness for both public health and the health care purchasing functions of government. The State faces risk related to program continuity from creating two departments where just one existed before in addition to the challenges of operating the two departments while increasing accountability and program effectiveness to meet the Legislature’s expectations. department of Corrections and Rehabilitation Corrections is one of the largest state departments in California. Headquartered in Sacramento, its operations stretch statewide with 33 adult institutions and 38 adult conservation camps. Corrections is responsible for the care and rehabilitation of the men and women inmates in its custody. For fiscal year 2007–08 the governor proposed a budget of $10 billion and 66,000 positions for Corrections. In May 2007 we met with several Corrections’ staff and discussed the challenges that Corrections faces. Staff agreed that Corrections faces the challenges we have identified. Overcrowding Although a recent follow-up review we conducted confirmed that Corrections still has problems with its inmate population projections, the With overcrowding, it is important for Corrections to have sound projections of its inmate population. current overcrowding situation is severe. Based on Yet, since 2005, the bureau has twice reported that Corrections’ data from February 28, 2007, it has Corrections struggles to properly project its inmate population: more than 171,000 male and female adult inmates in its custody. Of these, 94 percent (160,830) are • California Department of Corrections and Rehabilitation: Inmate Population Projections housed in institutions; the remaining 6 percent Remain Questionable (Report 2007-503, are housed in camps, community correctional March 2007) centers, state hospitals, and at institutions in other • Department of Corrections: It Needs to Better states. Corrections’ data also show that its institutions Ensure Against Conflicts of Interest and to Improve Its Inmate Population Projections are at more than 200 percent overall capacity; the (Report 2005-105, September 2005) individual institution’s occupancy rates range from a low of 130 percent at the California Medical Facility to a high of 257 percent at Avenal State Prison. Prison overcrowding presents numerous problems. The obvious challenges are protecting the health and safety of prison staff and inmates. However, additional issues emerge, including the following: • Limited opportunities for inmates to participate in education, substance abuse treatment, and other programs when such program space is used for housing. 22 California State Auditor Report 2006-601 • Stresses on a prison’s infrastructure such as sewage and water systems to safely and effectively service a large population. • Meeting the constitutional rights of inmates to receive minimum standards of treatment. Solutions to prison overcrowding have been slow in coming. One solution that has received a great deal of recent attention is to expand existing facilities. Although adding space to existing facilities may occur more quickly than constructing a new prison, construction is not an immediate solution because it sometimes takes years to design, contract for, and construct new space, and to bring that new space online. In the summer of 2006 the governor sought more immediate solutions to overcrowding by calling a special legislative session, but the session ended with no apparent resolution. Then in October 2006 the governor declared a state of emergency and used this declaration to, among other things, transport inmates to out-of-state prisons. Since that time, a small number of inmates have been transferred to other states’ facilities; however, the ability to continue these transfers is in doubt. A lawsuit against the State was filed to block the transfers, and the lower court sided with the plaintiffs. The State appealed that ruling on April 5, 2007, and as of May 23, 2007, the court’s ruling is pending. Also, in April 2007, the governor and certain legislative leaders announced an agreement that they believe will reform California’s correctional system and resolve overcrowding. Assembly Bill 900 (Chapter 7, Statutes of 2007) is a complex plan that is designed to do the following: • Add new prison beds at state facilities in two phases and increase the number of beds in county jails. • Provide inmates with rehabilitation services, such as education, vocational programs, and substance abuse treatment programs. • Continue the voluntary and involuntary transfer of inmates to out-of-state facilities for the next four years. The law authorized funding the prison construction with a mix of bond funds and General Fund money. To proceed with the second phase of construction, Corrections must meet specific construction and programmatic benchmarks, including successfully completing construction of one-half of the phase one California State Auditor Report 2006-601 2 prison beds, averaging 75 percent participation in available drug treatment programs, and properly assessing and placing inmates in rehabilitation programs both when they enter the correctional system and when they are within one year of parole. In spite of these recent efforts, overcrowding in the State’s prisons persists. In addition, much of the current proposal may take a considerable amount of time because prison construction or expansion can take years to complete. Meanwhile, Corrections has estimated that it will run out of bed space as early as June 2007. Promptly achieving a successful resolution to prison overcrowding is especially critical because, as of May 23, 2007, a federal judge is considering motions regarding the overcrowding issue that could result in federal intervention relating to inmate population. Health Care Receivership In June 2005 the United States District Court for the Northern District of California ruled that it would establish a receivership to take control of the State’s prison health care system. This action came three years after Corrections agreed to meet various conditions related to inmate medical care as part of a settlement agreement in the Plata v. Davis lawsuit. In court documents, the judge stated that the State’s prison medical care system is broken beyond repair, that the harm already done to the prison population could not be more grave, and that the threat of future injury and death is virtually guaranteed in the absence of drastic action. Additionally, the judge noted that it is an uncontested fact that, on average, one California prison inmate needlessly dies every six to seven days due to constitutional deficiencies in Corrections’ medical delivery system. In February 2006 the federal judge appointed a receiver to oversee the State’s prison health care system and ordered the receivership to remain in place until the court is satisfied that the State has the will, capacity, and leadership to maintain a system of providing constitutionally adequate medical health care services to inmates. The receiver testified before a legislative budget subcommittee in early February 2007. He told the subcommittee that he was unable to provide a dollar amount for what the needs will be to correct the system. He added that every aspect of the prison medical system was broken and that fixing it would cost what it was going to cost. The receiver retains complete discretion over spending to meet the prison system’s current medical needs and to devise a plan and implement a system that will bring prison 2 California State Auditor Report 2006-601 medical care up to federal constitutional standards. For fiscal year 2007–08, the governor proposed a medical budget for Corrections of roughly $1.8 billion. In March 2007 the receiver issued his fourth bimonthly report describing the following successes in establishing a constitutionally adequate health care service system for inmates: • Established appropriate salaries for specific clinicians and support classifications as well as physicians in the prison medical care system. • Drafted a comprehensive workforce development plan to recruit and retain clinicians. • Entered into an agreement with a private pharmacy management consulting service to develop a constitutionally adequate pharmacy system. • Planned for additional medical beds, including an initial assessment of the impacts of chronic disease and physical impairment on the prison population. The receiver has been in place for one year as of April 2007 and still faces many challenges. In two reports the bureau has recommended In a press release dated March 20, 2007, the needed reforms for aspects of Corrections’ medical receiver indicated that five to 10 years are care system: needed for Corrections’ medical delivery system • California Department of Corrections and to reach constitutional levels with possibly an Rehabilitation: It Needs to Improve Its Processes for Contracting and Paying Medical additional equal amount of time to transition Service Providers as Well as for Complying the management of the medical system back With the Political Reform Act and Verifying the to the State. According to the receiver, “Nearly Credentials of Contract Medical Service Providers (Report 2006-501, April 2007) every aspect of medical care delivery in the State’s • California Department of Corrections: More prison system requires substantial reform. The Expensive Hospital Services and Greater Use of tasks involved in the system’s repair are numerous Hospital Facilities Have Driven the Rapid Rise in and complex, and following decades of neglect and Contract Payments for Inpatient and Outpatient Care (Report 2003-125, July 2004) mismanagement, all of the existing problems cannot begin to be completed in the next one to two years.” On May 14, 2007, the receiver issued a report on overcrowding in response to the court’s order. In his report the receiver makes it clear that overcrowding in Corrections’ facilities is having a real effect on his ability to implement necessary health care reforms. According to the receiver, overcrowding will result in California State Auditor Report 2006-601 2 necessary health care reforms costing more and taking longer. Restoring the prison health care delivery system is clearly a long-term risk to the State. Reorganization In a letter to the governor and Legislature dated February 2005, the Little Hoover Commission stated that the correctional system’s organizational structure contributes to persistent and serious problems, including egregious cost overruns, inmate abuse, and parolee failure. Several bureau reports also highlight practices at Corrections that contribute to its cost overruns, including frequent These bureau reports highlight issues that have historically contributed to cost overruns as the use of sick leave by custody staff, spending plans Little Hoover Commission noted: that do not correspond to its spending authority, • California Department of Corrections: A Shortage a shortage of custody staff that results in increased of Correctional Officers, Along With Costly Labor overtime, and the lack of an infrastructure for Agreement Provisions, Raises Both Fiscal and Safety Concerns and Limits Management’s Control inmate health care similar to a managed care (Report 2002-101, July 2002) organization. The Little Hoover Commission’s • California Department of Corrections: Its Fiscal letter summarized its review of the governor’s plan Practices and Internal Controls Are Inadequate to to reorganize the Youth and Adult Correctional Ensure Fiscal Responsibility (Report 2001-108, November 2001) Agency. The letter concluded that the proposed • California Department of Corrections: Poor reorganization, although not perfect, was a good Management Practices Have Resulted in Excessive place to start. Effective July 2005 the departments Personnel Costs (Report 99026, January 2000) of Corrections and the Youth Authority, the boards • California Department of Corrections: Utilizing of Prison Terms and Corrections, the Youthful Managed Care Practices Could Ensure More Cost-Effective and Standardized Health Care Offender Parole Board, and the Commission on (Report 99027, January 2000) Correctional Peace Officers’ Standards and Training combined into a single agency, the Department of Corrections and Rehabilitation. Shortly after the reorganization, in January 2006, Corrections published its strategic plan. The document is meant to guide the agency in its newly organized form and “build the foundation for lasting change.” The plan includes seven goals and attendant strategies as well as time frames for completing key actions. Corrections’ goals include developing a well-trained, quality workforce; developing information technology strategies and implementing systems for current and future needs; achieving organizational excellence in operations and systems; developing preventative strategies related to risk management and legal compliance; developing a comprehensive crime prevention program to promote community safety; and establishing a managed health care system. In its strategic plan, Corrections notes that some components of its goals have been met; other short- and long-term goals are still in development. Given the 26 California State Auditor Report 2006-601 challenges represented by overcrowding and the health care receivership, it will be important for Corrections to continue measuring and realigning itself with its goals to ensure that it implements its strategic plan and achieves the changes intended by its reorganization. Leadership During 2006 two individuals that served as the secretary of Corrections—the agency’s top post—abruptly resigned and a third individual was appointed. Corrections provided us an organizational chart as of March 2007 generally listing positions down to the deputy director level at its headquarters. The organization chart shows that 34 percent of Corrections’ management positions are either vacant or have staff working in an acting capacity. A similar analysis as of April 2007 revealed that 34 percent of the wardens that oversee individual adult institutions are also working in an acting capacity. Lack of consistent leadership at the top and in its upper and mid-level management hampers an organization’s ability to succeed. Corrections’ turnover in its secretary position came at a time when it had just implemented its reorganization and was planning to launch its strategic plan. With a large number of vacancies and employees in an acting capacity in key upper and middle management positions, Corrections is at risk because management cannot provide the continuity in leadership needed for it to maintain stability or to move forward. Without permanent leadership, the organization cannot effect the changes embodied in its reorganization and strategic plan. Additionally, without consistency in leadership it is difficult to hold staff accountable for solving problems. In accordance with the criteria we describe in detail in the Appendix, we will look for Corrections to take steps to mitigate its risks in the four areas described: overcrowding, improving its health care delivery system, implementing its reorganization, and establishing consistent leadership. Corrections will need to demonstrate that it has the necessary resources to mitigate the risks we have identified and that it is implementing corrective actions recommended by the bureau or other state oversight agencies. We will use our professional judgment to assess whether the risks have been sufficiently mitigated. At that time, we will remove Corrections’ high-risk designation. California State Auditor Report 2006-601 2 department of health Services Health Services is another large department that we consider to be at high risk. For fiscal year 2006–07, the department had 6,000 authorized positions and a budget of more than $38 billion. In its current form, Health Services’ mission is to protect and improve the health of all Californians. It administers a broad range of public and environmental health programs, including those targeting obesity, communicable diseases, and food-borne illness. Health Services also administers the California Medical Assistance Program (Medi-Cal), which provides health care services to eligible low-income persons and families. In July 2007 Health Services will split into two new departments: the Department of Health Care Services (Health Care Services) and the Department of Public Health (Public Health). Senate Bill 162 (SB 162) (Chapter 241, Statutes of 2006), established the requirements for the split. As early as April 2003, in a report titled To Protect & Prevent: Rebuilding California’s Public Health System, the Little Hoover Commission recommended that the governor and the Legislature create a public health department, one separate from Medi-Cal, to focus on emerging health threats. Its recommendation resulted from a finding that “the State’s public health leadership and organizational structure is ill-prepared to fulfill the primary obligation of reducing injury and death from threats that individuals cannot control, such as environmental hazards, bioterrorism and emerging infectious diseases.” The Little Hoover Commission also found that the public safety functions of public health have not been given priority and public health resources are not adequately managed and tracked. In staff analysis of SB 162, the stated intent for the bill is to provide stronger, more focused leadership in public health and to give the State’s role in public health a significantly higher priority. Further, its author noted that public health programs and goals are constantly overlooked and overshadowed by the Medi-Cal program. Through SB 162, the Legislature established the following expectations for the two new departments: • Elevate the visibility and importance of public health issues in the policy arena. • Increase accountability and require program effectiveness for the public health and health care purchasing functions of state government. 2 California State Auditor Report 2006-601 An additional expectation the Legislature expressed was for the reorganization to be budget neutral; that is, it did not intend to provide state funding for the two separate departments, Public Health and Health Care Services, in excess of the total state funding previously appropriated to the former Department of Health Services, with possible exceptions for caseload and inflation adjustments. As a new department, Health Care Services will have responsibility for administering the Medi-Cal The bureau has issued these reports recommending program and will be challenged to meet the needed reforms for certain aspects of Health Services’ Medi-Cal program: Legislature’s expectations of increased accountability and program effectiveness. In several reports the • Department of Health Services: It Needs to Improve Its Application and Referral Processes bureau has identified deficiencies in Health When Enrolling Medi-Cal Providers (Report Services’ Medi-Cal program. For example, in a 2006-110, April 2007) report dated April 2007 the bureau concluded that • Department of Health Services: It Needs to Better the Provider Enrollment Branch (branch) within Plan and Coordinate Its Medi-Cal Antifraud Activities (Report 2003-112, December 2003) the Medi-Cal program—established to review • Department of Health Services: It Needs to applications and prevent providers with fraudulent Significantly Improve Its Management of the intent from participating in Medi-Cal—does not Medi-Cal Provider Enrollment Process (Report always process provider enrollment applications 2001-129, May 2002) within statutory time periods. The bureau’s report also concluded that the branch does not adequately track applications referred to other units within the department for secondary review, limiting the branch’s contribution to preventing Medi-Cal fraud. The bureau also repeated concerns raised in a May 2002 report regarding branch staff making data-entry errors, which decreases the branch’s ability to effectively track the status of provider enrollment applications. The State’s new Department of Public Health will perhaps face even greater challenges than Health Care Services. According to the Little Hoover Commission, the State’s public health system has lacked focused leadership, coordination of efforts, and an informed public process. In addition, public health epidemics already exist, and certain diseases are poised to become epidemics. As a result, California faces significant risks related to various public health issues, including the following: • obesity. Adults and children are being diagnosed as obese in alarming numbers, especially children. Obesity has a multitude of health issues related to it, including high blood pressure, heart disease, stroke, and diabetes. (Source: Department of Health Services.) California State Auditor Report 2006-601 2 • Communicable diseases. Avian flu and tuberculosis are two diseases that could reach epidemic proportions. Up to now no confirmed cases of avian flu have been reported in the continental United States. However, with the relative ease with which air travel and other modes of transportation can physically connect communities, the spread of disease is a serious threat. With regard to tuberculosis, although the number of cases in California have been declining, they continue to rise worldwide, and more significantly, drug-resistant strains have evolved. (Sources: Department of Health Services and the World Health Organization.) • Food-borne illness. The September 2006 outbreaks of Escherichia coli (E.coli) in fresh spinach represents a threat in the form of a food-borne illness that was ultimately traced back to spinach harvested in California. (Source: Department of Health Services.) We met with Health Services’ staff to discuss the risks inherent in its division into two departments. As Health Services undertakes splitting into two departments it will need to be careful to avoid waste through duplication of effort and ensure that all required programs continue without interruption. Health Services’ staff told us that the department was currently engaged in a great deal of planning surrounding program and staff placement and that Health Services was communicating continually with the public and its staff so that each group has the information they need leading up to and following the split. In addition, the staff indicated that the two new departments would continue engaging in strategic and business planning following the split. In accordance with the criteria we describe in detail in the Appendix, we will look for the departments of Public Health and Health Care Services to take steps to mitigate the risks we have described. Each department will need to demonstrate that it has the necessary resources to mitigate the risks and that it is implementing corrective actions recommended by the bureau or other state oversight agencies. Using our professional judgment, we will determine whether the risks have been sufficiently mitigated to warrant removing our high-risk designations. 0 California State Auditor Report 2006-601 We prepared this report under the authority vested in the California State Auditor by Section 8546.5 of the California Government Code. Respectfully submitted, ELAINE M. HOWLE State Auditor Date: May 31, 2007 Staff: John F. Collins II, CPA, Deputy State Auditor Sharon L. Fuller, CPA Lois Benson, CPA Ly Huynh Tim Jones Tina Kobler Jessica Oliva California State Auditor Report 2006-601 1 Blank page inserted for reproduction purposes only. 2 California State Auditor Report 2006-601 AppendIx Considerations for Determining High Risk inTRoduCTion Senate Bill 1437 of the 2003–04 Regular Session of the Legislature (Chapter 251, Statutes of 2004) added Section 8546.5 to the Government Code to provide the Bureau of State Audits (bureau) with the following authority: • To establish a high-risk government agency audit program for the purpose of identifying, auditing, and issuing reports on any agency of the State, whether created by the Constitution or otherwise (state agency), that the bureau identifies as at high risk for the potential of waste, fraud, abuse, or mismanagement or that has major challenges associated with its economy, efficiency, or effectiveness. This includes challenges that cut across programs or management functions at all state agencies or multiple state agencies; we refer to these as statewide issues. • When identifying state agencies or statewide issues that are at high risk, in addition to reviewing the work of the bureau, to consult with the Legislative Analyst’s Office (Analyst’s Office), the Milton Marks “Little Hoover” Commission on California State Government Organization and Economy (Little Hoover Commission), the Office of Inspector General, the Department of Finance (Finance), and other state agencies with oversight responsibilities. • To issue audit reports with recommendations for improvements in state agencies or with regard to statewide issues identified as at high risk not less than once every two years. • To require state agencies identified as at high risk, including state agencies with responsibility for a statewide issue, to periodically report to the bureau on the status of recommendations for improvement made by the bureau or other state oversight agencies. California State Auditor Report 2006-601  In addition, Section 8546.5 requires the bureau to notify the Joint Legislative Audit Committee whenever it identifies a state agency or statewide issue as at high risk. To establish our inaugural list, we focused on defining and applying the criteria to identify state agencies and statewide issues that present a high risk to California. For our inaugural high-risk list, we used the criteria described in this appendix to do the following: • Identify major program areas within state government and assess performance. • Assess and determine how agencies’ management functions contribute to program performance, achieve results, and ensure accountability. • Determine state agency and statewide issues and whether they merit a high-risk designation. • Assess what level of risk mitigation warrants the removal of a high-risk designation. meThodology And CRiTeRiA Based on our experience in examining a wide range of government programs, we identified major program and mission areas administered by one or more state agencies that might warrant consideration as high risk because they: • Are at the center of legislative and executive branch attention. • Command high public interest and/or involve large dollar outlays. • Figure prominently in various oversight agencies’ reports. • Have known performance and accountability or high-risk issues. In assessing state agencies and major statewide issues and making high-risk determinations, we drew from information available through a number of sources, the primary source being the bureau’s performance, financial, compliance, and investigative reports, and testimonies. Other sources of information included the following:  California State Auditor Report 2006-601 • The governor’s budgets. • Reports or studies from various state control or oversight agencies. • Reports by federal entities such as the U.S. Government Accountability Office, the Inspectors General, or cognizant agencies. • Reviews or white papers by outside study panels, commissions, and work groups. • Reports by legislative committees. In accordance with Section 8546.5, we consulted with various state control agencies—Finance, the Analyst’s Office, the Little Hoover Commission, and the State Controller’s Office. In addition, we met with legislative budget and fiscal committees to obtain their perspectives on the challenges and high risks facing the State. Finally, we met with staff at state agencies having a key role in a high-risk area or those designated in this report as at high risk to ascertain their perspective on the risks they face. Criteria for determining if State Agencies and major issues the State faces merit high-Risk designations To determine whether a state agency’s performance and accountability challenges are of high risk to the State, we first considered the significance of an agency’s mission or functions and the extent to which the agency’s management and program function is key to the State’s overall performance and accountability. We then determined whether risk was involved and if it stemmed from one of the following: • A risk that could be detrimental to the health and safety of Californians. • The nature of a program could create susceptibility to fraud, waste, and abuse. For example, a program involving payments to claimants for services provided to third parties involves risk due to the difficulty in verifying claims. • A systemic problem that has created inefficiencies and ineffectiveness. California State Auditor Report 2006-601  To identify a high-risk statewide issue we considered the following: • Is it evident in several state agencies? • Does it affect the State’s total resources? • Does it stem from some deficiency or challenge that warrants monitoring and attention by the Legislature through the Joint Legislative Audit Committee, the Joint Legislative Budget Committee, other legislative committees, or other legislative action? For both state agencies and statewide issues, we also considered a number of qualitative and quantitative factors as well as whether or not an agency has taken corrective measures for deficiencies previously identified or whether the State is taking measures to reduce the risk a statewide issue may pose. In all cases, the ultimate determination of high risk is based on the independent and objective judgment of the bureau’s professional staff. Qualitative and Quantitative Factors In determining whether a state agency or statewide issue should be identified as at high risk, we considered a number of qualitative and quantitative factors. Although we considered many qualitative factors, in particular we focused on whether the risk could result in significantly impaired service; program failure; significantly reduced efficiency and/or effectiveness; public injury or loss of life; reduced confidence in government; or unauthorized disclosure, manipulation, or misuse of sensitive information. To the extent possible, we took into account the risk to the State in terms of monetary or other quantitative aspects. For this inaugural list, we considered that a $1 billion investment by the State for a program would be an indicator of potential material loss. Further, we looked at the changes in assets—additions and deletions—as an indicator of potential risk to major agency assets being lost, stolen, or damaged. We further considered risks that revenue sources may not be realized or improper payments may be made. Finally, we considered the number of employees each state agency is authorized to hire in determining the magnitude of human capital. 6 California State Auditor Report 2006-601 Responsiveness to Recommendations and Corrective Measures State law requires the bureau to follow the Government Auditing Standards issued by the Comptroller General of the United States (California Government Code, Section 8546). In accordance with those standards, it has been the long-standing practice of the bureau to request auditees to report back at 60-day, six-month, and one-year intervals on progress they have made in implementing recommendations we have made to them in our audit reports (agency responses). Recently enacted legislation, Senate Bill 1452 of the 2005–06 Regular Session of the Legislature (Chapter 452, Statutes 2006), explicitly requires that state agencies provide the bureau with updates on the implementation of those recommendations in the form and intervals prescribed by the bureau. Moreover, Senate Bill 1452 places additional reporting requirements on state agencies that have not implemented audit recommendations that are over one year old. The bureau also receives whistleblower complaints about improper governmental activities under the California Whistleblower Protection Act and regularly issues public reports on substantiated complaints. That act requires state agencies to either take corrective action on substantiated complaints and report to us what action is taken, or if no action is taken, the reason for not doing so. For subsequent high-risk designations, we will consider whether each state agency audited or investigated demonstrated commitment in implementing audit recommendations or taking corrective measures for any substantiated complaints or issues noted in our reports. Although agencies’ responses were considered in this high-risk list and will be in future lists, the final determination on how committed agencies are about making changes to address audit recommendations or taking corrective measures stemming from investigations may include additional follow-up reviews by the bureau and ultimately is based on our professional judgment. ongoing Reporting and future Audits Once the bureau identifies as at high risk a state agency or statewide issue, the bureau may require the affected agencies to report on the status of recommendations for improvement made by the bureau or other state oversight agencies. Related to that, the bureau may require affected agencies to periodically report their efforts to mitigate or resolve the risks identified California State Auditor Report 2006-601  by the bureau or other state oversight agencies. In addition, the bureau may initiate audits and issue audit reports with recommendations for improvement in the affected agencies. Removal of high-Risk designations When we designate agencies or statewide issues as at high risk and place them on our high-risk list, removing the designation takes a demonstrated commitment by the leadership of the state agency or agencies responsible for addressing the risk. The agency or agencies should appoint a person, group, or entity responsible to address the risk, and those responsible must devote sufficient resources to mitigate or resolve it. Further, those responsible must develop detailed and definitive action plans, including, when necessary, plans to seek legislative action. Those plans should define the root cause of the risk, identify cost-effective solutions, and provide a timetable for completion. Moreover, the responsible party must have a process for independently monitoring and measuring the effectiveness of steps taken and for periodic reporting regarding progress. When legislative and agency actions, including those in response to our recommendations, result in significant progress toward resolving or mitigating a high-risk area, we will remove the high-risk designation. The agency or agencies must also demonstrate progress in implementing corrective measures. However, we will continue to closely monitor these areas. If risks again arise, we will consider reapplying the high-risk designation. The final determination of whether to remove a high-risk designation will be based on our professional judgment.  California State Auditor Report 2006-601 cc: Members of the Legislature Office of the Lieutenant Governor Milton Marks Commission on California State Government Organization and Economy Department of Finance Attorney General State Controller State Treasurer Legislative Analyst Senate Office of Research California Research Bureau Capitol Press California State Auditor Report 2006-601