Legislative Audit Committee Hearing [Apr 01, 2026]

Good morning, Senators and Representatives.

Brooks. Present.

Lindstadt. Present. Pelton. Here.

Wiseman. Good morning. Madam Chair. Present. Madam Chair, you have a quorum.

So moved.

Thank you, Madam Chair. Would the auditor have some insight for us before we kind of dive into things on what she received yesterday?

Thank you, Madam Chair and Senator Pelton. You have a hard copy in front of you that we just received yesterday from the Office of Information Technology. And they've provided an executive summary of their technical debt reduction and infrastructure improvements. And it's specifically related to the question that came up at last week's hearing on the funding that OIT has received in the last three years to adjust the state's technical debt as well as infrastructure improvements. So they did provide detailed information about their appropriations for the last three years, FY23 through FY25, expenditures related to those, amounts committed, and any remaining funds, which they're showing as zero. So that's what we have. It was, like I said, just got that yesterday.

Thanks. I guess just to sort of share my own thinking on this since last week for other members. I mean, we started down the road of sort of what's the budget angle here, and we were discussing a footnote. Something I've come to appreciate over the years is the budget committee doesn't just move the money around. They're also an oversight committee. and I think the idea with this letter is to leverage their oversight role specifically their RFI process so here we have the idea of kind of an annual roll up I've seen these get approved and sent in the direction of parts of the executive branch on kind of a rolling basis through the budget cycle November through spring on other subjects and I think the information that comes back in response to them and that is made available to the rest of us through the budget committee and staff can be super helpful. So subsequent to last week, the auditor and the chair and I traded some emails and just arrived on the idea of leveraging this RFI process. And we had the idea of just asking for a pretty detailed accounting, you know, million-dollar chunks at a time of where is this kind of shockingly large amount of money going. I guess I'm pleasantly surprised that we have a little bit of a down payment in terms of the letter in front of us. Given that they've at least got this pulled together, I think it's hopefully going to be relatively shorter work for the office to proceed from what they've already done with this letter we just received to a full and even more detailed response to the letter that we've put forth. But I guess in some, the idea was, you know, use the budget process. Use the accountability that is rightly demanded from our colleagues over there to start to resolve this issue we've been grappling with here.

Thank you. I just had a question about the timeline in the proposed letter. I'm not sure who to direct it to, though. I would think Auditor Hunter. She would like to have staff come up.

I'm curious about the July timeline and the RFI. And also, I think I'm also curious about the JBC budgeting cycles as well, and perhaps if you know when the first rounds of budget talks and proposals might be as well. And I'm curious if you might be able to help expand upon how, I like July 1 because it's sooner than later, but how it can also help connect to next year's budget request cycle. Do you have any insights there?

Thank you, Madam Chair and Representative Bacon. A little bit. I will tell you, the July 1st date came about through kind of our drafting and back and forth and trying to land on a date. In looking at last year's RFI letter, the April 2025 letter that was for FY25, there were a lot of November 1st dates. It varied a little bit. But in discussions with the chair and vice chair, I had said, if we want an earlier date, we can go with an earlier date. And so that's where we went with the July 1 just because November felt quite a ways away. And so July 1 felt like, okay, that gets them through the fiscal year, and they're giving us a report on that. So I think in terms of the budgeting specifically, I think the November 1st date typically is aligned with that's right before the JBC starts meeting for the budget discussions.

Thank you. And just, you know, for the record, we are proposing to put a footnote on the next fiscal year's budget, 26-27. I am curious if you all discussed or might be interested in having another checkpoint. I do believe the November cycle is the first rounds of when the agencies are proposing their budgets, and it kicks off the budget request comeback season that we have. And so I'm curious if we did think about perhaps another check-in around not just the budgeting season to begin for the following fiscal year, but anything that we can look at, particularly around the time of supplementals, which comes earlier in the year. And supplementals are adjustments to that fiscal year's budget. And so I think what I'm curious about and interested in across from our committee here, I do think July 1st is sooner than later and incredibly helpful. I'm just wondering if we may also be able to say something about a midpoint check-in to kind of reflect actual spending around the supplemental season to also then help us be informed for the following fiscal year's budget as well, which is, you know, January, February time.

Thank you, Madam Chair and Representative Bacon. A couple of things that I wanted to mention on that. Related to the footnote discussion from last week, I had checked in with JBC Director Harper, And he had indicated that from specifically adding the idea of adding a footnote to the long bill, he had said that was the prior process years ago. But at this point, he said from discussions that JBC has had with legal services, they've settled on footnotes as the tool for the General Assembly more to specify their intent related to the use of money. So, for example, providing roll-forward authority for expenditures over multiple years or indicating the intended use of funds. So he had indicated that the official RFI letter that this letter would be related to, putting that letter in the RFI letter, is their official process now for doing that. So I just wanted to clarify and provide that follow-up information that I had gotten from them. And in terms of adding another date or however the committee would like to do that, I'm happy to make edits to the letter to, say, by July 1 and January 1 or whatever you all would prefer.

Yes.

And so for clarity's purpose, if we did have another date, we would put it in the RFI letter, not necessarily a footnote. Is that what you're saying?

Thank you, Madam Chair and Representative Bacon. Yes, that would be JBC staff's preference and their normal process based on what he has told me, that that wouldn't be something that they would at this point probably put in a footnote.

We'll go next to Representative Johnson and then Vice Chair Weissman.

Auditor Hunter Thank you Madam Chair Representative Johnson We can do that and have them come in and provide their stated updates related to that In terms of our process and our follow-up, we are scheduling or starting to work on requesting information from OIT on their June 30, 2026 implementation status of the cybersecurity recommendations. We've asked for them to provide that in July, and I think they had indicated there were 32 recommendations that they had planned to implement out of those. And so Matt Devlin, Chief IT Auditor, and Cindy Radke, IT Manager, will be doing testing late this summer and fall just to do some verification of the department's self-reported implementation status. So we were planning to bring OIT back for that status report probably at the December hearing is what we're hoping now. but for what you're asking, we could have them come in sooner. Just to clarify, though, we won't be able to provide information to the committee at that point at an earlier date as to whether we feel like what they're saying, that we've done some verification with that.

Okay, great.

Thank you. So, you know, I think Rep. Johnson and the auditor got there, but I guess just to affirm it. As far as follow-ups to Rep. Bacon's point, just looking at the calendar of dates that we agreed to for the interim previously, we have August 10, I think is the first one, after July 1, and December 7 would be following the official opening of the next budget cycle. So those two maybe are the most fitting occasions, although we have two other meetings as well in the interim to bring this issue back here and make it part of our half-day or full-day agenda. And I think taking a look at what the response was to the RFI and folding that into the ongoing review, like you just mentioned, Ms. Hunter, it makes a lot of sense to me.

Representative Bacon. Thank you. I think what I would be interested in, particularly around December 7th at the budgets open, is to just not only name the expectations we hope to see completed and report, I'm sorry, the letter that we are writing seems to suggest we would like to see their benchmarks and their progress to their goals. The reason why I'm asking for us to also include a date is for us to somehow unofficially codify that we have set a benchmark, and we do also want to monitor their progress to their goals in the next budget year for as close as we can get to have an eye on actual spending to the performance. And so if we can somehow include that, you know, we're very clear of what we hope to see in the July 1st letter. But I think what I'm hoping is that we can also serve as some sort of accountability measure for their progress monitoring in a budget year so we don't have to wait for another one. So if that means we meet in December 7th, I know we can talk now about what we hope our agenda could be, but I'm wondering if we can articulate it in our letter or perhaps also include, if it's not December, then maybe our January meeting. You know, we'll be six months into a budget by then.

Auditor Hunter. Thank you, Madam Chair. Representative Bacon. So if I'm hearing you right, there would be, we could include in the letter an expectation or include in our letter and ask the JBC to include in the RFI letter their required reporting by July 1 and also a request or putting them, letting them know that we would expect to have them attend the August, and I don't have the date in front of me, but the August whatever date that is, LAC hearing to provide that reporting, and then in December to further discuss.

Auditor Hunter. Thank you, Madam Chair. Rhett Bacon. Happy to put that in there. I also think at the August LAC hearing, if the committee feels like there's continued concerns with OIT or you want to make the JBC aware of something tied to the budget at that time, I think I could draft another letter that we send at that point to JBC, but I'm happy to also put a sentence in this one. Yeah.

You're good?

Auditor Hunter. Thank you, Madam Chair. I guess I just want to confer a couple of things. The first paragraph that we proposed in the letter does request that they provide the, I'm sorry, the second paragraph. talks about the OIT providing that detailed accounting of the spending. The discussion last week was about spending of a total of approximately $60 million. Based on the letter that OIT provided yesterday, they're showing spending of about a little over $83 million. dollars. So I'm wondering first I would propose that I change that number in the letter and just wanted to confirm that there's no other changes other than what we talked about with the addition of the LAC hearings.

Auditor Hunter? I can do that. Yes, that makes sense. Is there any additional detail that the committee would like to see in this letter with respect to this request? Because, just a sec.

Thank you, Representative Titone. Is it more... So I'm going to ask a question back. Is it more appropriate for the Joint Technology Committee to make that request separate of this particular one or is it more appropriate for the JTC to join this letter? Because we could go about this a couple of different ways. And the reason why I'm asking is that, and this is perhaps only my opinion, but I don't know that it's the role of the Legislative Audit Committee because right now we're looking at an audit on cybersecurity resiliency, and that is our focus, and that does not include an audit of cash funds. So that's why I'm just kind of bouncing this back to you,

Representative Bacon. Sorry, thank you. I perhaps I misunderstood or maybe I don understand in regards to the cash fund what audits exist for the cash fund if any

Vice Chair Weissman. Thank you. I would assume that the Comptroller's Office could pull essentially a transaction register for this cash fund. And, Madam Auditor, maybe you could facilitate that. for any members of this committee and any other committee who are interested to see it. I know I have periodically made a request for different things from the Comptroller's Office, and they can pull a spreadsheet given a few days.

Senator Baisley, given that you're here as a member of the Joint Technology Committee, have, and I'm engaging both you and Representative Titone, have you on the Joint Technology Committee had conversations about generating a letter similar to what we have created in the legislative audit committee about these cash funds and making that specific request? Thank you, Madam Chair.

because I don't disagree with the request, Representative Chitone or Senator Baisley. I think that it's a valid request and it's an important request. But for the purpose of the cybersecurity resiliency audit, I feel pretty strongly that the legislative audit committee needs to, for lack of better terms, stay in our lane. We have specific and very broad requests going to the joint budget committee. and I would like for this committee to concentrate on the cybersecurity resiliency. And the cash fund is a completely, it's a separate topic, and I would be concerned about intertwining the two. And I would love to hear conversation from the legislative audit committee members if you feel differently or if you agree.

Thank you.

Auditor Hunter. Thank you, Madam Chair and Vice Chair Weissman. Thank you for your comments. I just wanted to say, because my staff are going to kill me otherwise, in terms of running reports, we run them as part of our audit. It's not something that we routinely do upon legislator requests, but from a committee standpoint, if there's something that you would like to see or something related, this did relate to an audit, we're happy to do that.

No worries, Madam Chair. I did, but Senator Weissman addressed the comments that I wish to share.

Sorry, Senator Beasley. Thank you, Madam Chair. Let me just add just a little bit of flavor. So, yes, in total agreement with what you're saying and the focus of the letter from this body versus where we're proceeding, where we're heading with the Joint Technology Committee. But specifically there, we've met with OIT management probably three times, something like that. I would prompt my colleague from the House, Representative Titone, to chime in on that. But during the month of March, we met with them, I believe it was three times. And there's an interesting tension between being supportive of them as a relatively new team of management that has reorganized the whole OIT, a whole new organizational structure, and at the same time keeping them accountable to where they have been over the past several years, reaching back before this new team was really gelled and in place and encouraging them to step it up and bring things to a good quality spending of the people's money with efficiency in supporting all of the agencies that they support but giving them the latitude at the same time to own that management philosophy and to be effective through their own skill set as a team, which they really seem to be coming together well. So you want to give them that latitude but hold them accountable, even for the past sins before their time. So that's where our letter was kind of heading, but I don't think it's been composed as yet. I just wanted to add the flavor. Thank you.

That's okay. Thank you, Madam Chair. So, I mean, I'm looking at this summary that OIT has given to you, and it's mostly on tech debt reduction and infrastructure improvements, but I don't really see a lot of the things that are listed in here that really apply directly to the problems that we're seeing in the IT security audit. And that's why I don't think that this is really the crux of the matter. I think that the problems that are stemming from a lot of the IT security issues are coming from other places. And that's why I think that there needs to be a broader outreach of information that needs to be gathered to understand what is causing these should-be pretty simple things to fix that are not being done and what are the reasons for those. And it's just my opinion based on what I have the information about. It seems like it goes back to that cash fund because I don't know what goes into that cash fund, what goes out of that cash fund, and what they use that for. are they using that for some of these things that they should be doing out of this cash fund? I don't really know. So that's why I think that the cash fund is relevant to the IT security audit question, more so than what is provided in this letter that OIT sent to you, and going into more detail on these particular tech debt reduction and infrastructure improvement line items, which are very straightforward. And I think that this is just more of like a smoke and mirrors to obfuscate what's really happening.

Representative Bacon Thank you I curious from the auditor team I think to this point I do believe that we are you know doing our best here to take a first step I'm wondering if we may be able to say that, you know, the auditor and the auditor's team has a set of recommendations. what was it, 12, 13 recommendations, and that we are progress monitoring their successes, can you quickly, I don't know if you all know, you probably do, off the top of your head, when we are talking particularly about this account, the retiring the technology, which recommendations this aligns to? because perhaps while we may not be able to solve all the problems, I wonder if there's a line in the letter saying that this team has found a need for 14 recommendations since 2023. This particular set of circumstances is to recommendation number whatnot or numbers whatnot. and maybe that if we can provide some monitoring for these, we then expect the others to fall in line and maybe do some sort of bridge to be like particularly this issue, which might be the cash fund. And so to rephrase, one, I'm curious what it is that we have put in this letter, which recommendations this aligns to, but could we note there are 12, or you can tell us how many, that ledge audit, that this is the one that we are going to begin with, this aligns with this recommendation, and we can at least note what we are curious about as a note to the JBC for perhaps future attention. And so can you help answer that? Mr. Devlin, happy to see you here.

Representative Dakin. Okay. I'm sorry for confusing the issues. I think perhaps, I think the statement, I think the whole point of this for us, the statement we are trying to make is, we know that there have been made, well, we just got our book here, and it's like there are 85 recommendations that are made. We are trying to connect the dots between performance and budget, even though that's not entirely how our systems always work. And so the fact that this is a footnote to the budget committee, I'm just wondering if we can just be clear of between all the legislators in this room, all the legislators on JBC, we are noting that there are performance audit issues that may connect to the budget. and to the extent to which we can manage. We are curious about meeting the benchmarks for the performance, but we want to also raise a flag of concern that it may also impact the budget. And not just through the line items, but also there is a cash fund. So I think what I'm getting at is, and thank you for that, and perhaps that is my problem for conflating it, but we are writing a letter and I guess I'm putting the fate of the world in two paragraphs so I apologize to Auditor Hunter but just can we be clear that we are triangulating something here we believe that this performance may have something to do with the budget and if we cannot get them to meet their performance benchmarks we have questions elsewhere And I think that's what I'm just wondering if we can note. So what we are going to ask for in this moment is clarity in the RFI. However, this is our overall concern. Sorry.

Yeah, thank you, Madam Chair. And I would just close with, again, as Auditor Hunter said, and, you know, staying in our lane, we are expecting to substantiate the recommendations and come back to the committee for this particular audit and the recommendations that OIT has agreed to, which is pretty much all of them except for one now, based on their implementation status. So we'll provide that to the committee plan for December and in conjunction with all the other business that you as a committee are taking care of on the other aspect.

Thank you, Madam Chair. I just want to confirm with OLLS whether or not they have a concern with that in terms of it being a letter and it going out or if it would be cleaner to have the committee vote to approve the final letter as amended as discussed and then I make the changes. Do you have thoughts on that?

Yeah, and along with that, can we vote by email, or do we have to call a meeting?

Good morning, Madam Chair, members of the committee. Jed Franklin with OLLS. I think what I would recommend is to make a motion about the letter, that you'll write the letter, and then you can confirm that over email. Thank you very much.

So moved.

Second.

So moved. So moved.

Yes, thank you, Madam Chair. I'm Marissa Edwards, Deputy State Auditor. We have one report on the list this morning, which is the Agreed-Upon Procedures Report for the U.S. Department of Housing and Urban Development for fiscal year 2025. As background related to this report, the Federal Department of Housing and Urban Development, or HUD, requires the Department of Local Affairs, as a direct recipient of federal housing grants, to submit specific financial information to HUD on an annual basis and for that information to be reconciled to the state's financial statements. We perform procedures required by HUD, and we determine the information prepared by the Department agreed to the supporting documentation without exception. Now that that report's been released, it will be available shortly on our website. So, Madam Chair, that concludes my presentation for this morning.