State High-Risk Audit Program

CDT HAS NOT MADE SUFFICIENT PROGRESS IN ITS OVERSIGHT OF STATE INFORMATION TECHNOLOGY PROJECTS​

Background​

The California Department of Technology (CDT) is responsible for approving, overseeing, and monitoring the State’s IT projects. As a component of this effort, CDT regularly reports on the progress of various projects as measured against their objectives, scope, schedule, and cost. Historically, the State has faced challenges in completing IT projects on time and within budget. Currently, CDT uses a four-stage process known as Project Approval Lifecycle (PAL), that is intended to ensure that larger projects—those anticipated to cost more than $5 million—include a strong business case, clear objectives, accurate costs, and realistic schedules. CDT’s goal in using PAL is to improve the quality, value, and likelihood of success for IT projects in California government.
We designated CDT’s oversight of IT projects as high-risk in our initial high‑risk assessment Report 2006-601, May 2007, because of the number of costly and complex projects that were underway and the State’s history of failed IT projects. In part to address these concerns, CDT implemented PAL in 2016. However, our state high-risk assessment, Report 2021-601, August 2021, found PAL’s effectiveness to be unclear since a sufficient number of projects—especially highly complex, and critical projects—had not been completed using PAL. We further noted in our Report 2022‑114, April 2023, that CDT will require new metrics to better track its effectiveness as it uses PAL to support more complex and critical projects.

Assessment​

CDT’s oversight of IT projects has yet to demonstrate significant improvement and will therefore remain on the state high-risk list. In Report 2022-114, April 2023, we noted that CDT’s oversight of IT projects has been ineffective at addressing risks on complex projects. During that audit, we reviewed CDT’s oversight of four IT projects and found that although CDT identified deficiencies in three which required immediate corrective action, it had not used its authority to ensure that the problems were resolved.
Moreover, CDT’s use of costly and lengthy approval processes can have negative consequences for agencies. As part of Report 2022-114, April 2023, we surveyed 143 agencies on their experience using the PAL process. Among the many agencies that had used CDT’s project approval processes—63 of those we surveyed—23 percent of those agencies were unsatisfied or very unsatisfied with the project approval process. Several agencies noted that the PAL process is too lengthy and that it delays the approval of projects. Timelines that stretch into multiple years can be costly to agencies and can delay updates to critical IT systems. PAL remains a lengthy process for agencies in 2023, and CDT has not clearly demonstrated its effectiveness.
CDT has not made sufficient progress in resolving issues with its oversight of IT projects to justify its removal from the high-risk list. CDT’s oversight process has been ineffective in addressing previously identified problems and CDT’s process is lengthy, leading to delays; thus, circumstances have not changed substantially. Further, CDT needs to better measure its process to assess its effectiveness; thus, adequate corrective action has not occurred. Finally, additional audit work by the State Auditor could follow up on Report 2022-114, April 2023, to assess CDT’s progress in implementing our recommendations, and generate new recommendations.

Status: Retained on the high-risk list​

CDT's response and State Auditor's comments

CLIMATE CHANGE AND AGING WATER INFRASTRUCTURE THREATEN CALIFORNIA’S WATER SUPPLY AND PUBLIC SAFETY​

Background​

We added the State’s water infrastructure as a high-risk issue in Report 2013-601, September 2013, noting that the State’s investment in water infrastructure had not kept pace with its needs and was aging. After the near-failure of the Oroville Dam spillway in 2017, we expanded this issue area in Report 2017-601, January 2018, to include dam safety. In our most recent high-risk assessment in Report 2021-601, August 2021, we noted that the State had not made appreciable progress toward addressing deficiencies in its water infrastructure and that safety planning for dams throughout the State remained incomplete.
Much of the State’s water storage is held in surface water, specifically in lakes behind dams. State law vests authority over dams in the State’s jurisdiction with the Department of Water Resources (Water Resources), a department in the California Natural Resources Agency (Natural Resources). Water Resources oversees these dams through its Division of Safety of Dams (Dam Safety Division), which inspects more than 1,200 dams, rates each dam’s condition as Satisfactory, Fair, Poor, or Unsatisfactory, and identifies the downstream hazard that the dam poses, which can range from Low to Extremely High. Condition rating assesses a dam’s physical condition; the downstream hazard rating assesses the impact if the dam fails.
After the Oroville Dam spillway incident in 2017, the Legislature amended state law to require that owners of state-regulated dams with certain levels of downstream hazard develop emergency action plans (emergency plans) to address the potential loss of life and potential property damage of a dam failure. Each emergency plan must include one or more inundation maps, which illustrate the potential flooding that may result from a dam’s failure. The California Governor’s Office of Emergency Services (Emergency Services) is responsible for approving emergency plans, and the Dam Safety Division is responsible for approving inundation maps, which are a component of every plan.
In our high-risk assessment Report 2021-601, August 2021, we focused our review of the sufficiency of California’s water supply by reviewing the progress of a project known as WaterFix, which is no longer proceeding. Our current review focuses in part on a new effort known as the Delta Conveyance Project which would develop new water infrastructure facilities in the Sacramento–San Joaquin Delta (Delta). The Delta Conveyance Project is intended to protect and preserve California’s water supply threatened by sea level rise, climate change, and seismic activity. The Delta Conveyance Project remains a component of Natural Resources’ greater water supply strategy. However, given California’s changing climate and the strategic planning that Water Resources and other agencies completed since our last review, we have expanded our current high-risk assessment to include a review of the State’s water strategies to ensure water availability and a review of certain levees under water infrastructure safety.

Assessment—Water Availability​

The State has not yet made sufficient progress in addressing the water availability issue area; therefore, it will remain a high-risk issue. Natural Resources estimates that hotter, drier weather could diminish the State’s existing water supply by up to 10 percent by 2040. With the State consuming between 60 and 90 million acre feet per year, this estimated 10 percent loss due to hotter, drier weather would mean 6 to 9 million acre-feet of water less per year in 2040. However, our limited water supply is already affecting many Californians. For example, although more than a million Californians rely on domestic well water, nearly 2,000 wells were reported dry as of May 2022.
California has recently experienced cycles of drought and water overabundance. For example, California’s $50 billion annual agriculture industry, which employs more than 420,000 people, has felt the effects of repeated droughts. In 2022 the Public Policy Institute of California estimated the economic impact of the 2021 drought at $1.7 billion and 14,600 jobs lost. By contrast, the State experienced record rainfall in 2023, which resulted in the State Water Project’s allocating 100 percent of the planned delivery to water contractors in 2023, whereas in 2021 and 2022, it was able to allocate just 5 percent of the water requested.
This drought-and-flood cycle also affects other elements of the State’s water infrastructure, such as its levees. Specifically, according to California’s Delta Stewardship Council, flooding in the Delta could result in loss of life and property losses in the billions of dollars. Moreover, the probability of a levee failure caused by high water levels is substantial based on historical performance. In the last century, there have been more than 140 levee failures and island inundations in the Delta. Ensuring reliable and safe water supplies is critical for the well-being of people, businesses, and communities throughout California.
The State is working to address these needs; however, progress remains slow. For example, Water Resources is in the process of completing an environmental review for the Delta Conveyance Project. The purpose of the Delta Conveyance Project is to modernize and protect the reliability of State Water Project water deliveries south of the Delta to help mitigate the effects of sea level rise, climate change, and seismic risk. The State Water Project provides clean, affordable drinking water to 27 million Californians and irrigation supplies to 750,000 acres of farmland. However, the Delta Conveyance Project is in a planning phase, and may face future challenges related to funding and the timeline for its completion. Water Resources states that it is on schedule to complete an environmental impact review by the end of 2023. It also states that permitting activities are underway or slated to begin soon. The Delta Conveyance Project is estimated to cost about $16 billion in total and, according to Water Resources, construction will likely begin in 2028 or 2029. While the Governor has recently signed legislation that would streamline various processes related to the environmental impact of specified infrastructure projects, the Delta Conveyance Project was explicitly exempted from these changes.
In addition to its work on the Delta Conveyance Project, the State has taken another important step in addressing its water needs since our last review. In August 2022, a variety of state agencies working cooperatively created a strategic water supply plan to help California adapt to its hotter, drier future. 5 This strategic plan calls for the creation of additional storage space for up to 4 million acre-feet of water to assist California in capitalizing on large storms when they occur. The plan also calls for increased water recycling, more efficient water use and conservation, and other methods that diversify the State’s response to climate change. The plan also specifies a variety of steps to meet these goals, such as expanding both desalination production and existing reservoirs. Although the strategic water supply plan is too recent to assess its effects, the plan notes that the State has supported related projects with budgetary increases of more than $8 billion earmarked for water infrastructure modernization and management. We will monitor the strategic water supply plan’s application and the use of related funding to determine its effects on California’s water resources over time.
Given the current risks and limited progress, the availability of water resources will remain a high-risk issue. The State’s cycle of ongoing drought and flood, as well as the still-pending Delta Conveyance Project and newly created strategic water supply plan for additional water storage, show that circumstances have not changed substantially and that water availability continues to be a high-risk issue. Finally, additional audit work by the State Auditor could assist in mitigating the risk presented by this issue area by proposing methods to streamline project management at the responsible agencies, as we did in Report 2016-132, October 2017, our audit of the WaterFix project. Such additional audit work could examine the State’s progress and barriers toward enhancing water storage, increasing recycling, and expanding desalination.

Status: Retained on high-risk list​

California Natural Resources Agency’s response

Assessment—Water Infrastructure Safety​

The condition of some of the State’s potentially most hazardous dams and related emergency planning remains a high-risk issue. Failures or incidents at dams could result in significant harm to the State and its residents, through loss of life and flooding of economically important areas. Nevertheless as of June 2023, 88 dams throughout the State have both a condition rating lower than Satisfactory and a downstream hazard rating of Significant or higher. Dams that fall within these classifications have a combined reservoir capacity of more than 7 million acre‑feet of water. Of particular concern, 37 of the 88 dams with condition ratings below Satisfactory are also rated as Extremely High Hazard, meaning that a dam failure would cause considerable loss of human life and significant economic loss. Water Resources indicates that since 2021, 11 dams have received some repairs and that the department has also identified numerous additional deficiencies. The State’s new strategic water supply plan indicates that Water Resources will administer $100 million in new funding for local dam safety projects and flood management, such as improving dam condition ratings. We look forward to assessing the impact this funding has on the issue area.
Since our August 2021 high-risk assessment, Water Resources has made significant progress in approving inundation maps, having approved maps for 805 dams, or 93 percent of the required inundation maps, an increase of more than 13 percentage points. However, Emergency Services’ approval of emergency plans lags behind. Emergency Services has only approved emergency plans—which outline action to be taken during an emergency to minimize or eliminate the potential for loss of life and property damage—for 419 of the nearly 900 dams required to submit such plans, or about 48 percent. Although this number represents progress—an increase from the 107 approved plans in 2021—it will take several years at the current rate of approval for the State to have clear emergency plans in place for all dams that require them. Further, there are 121 dams without approved emergency plans that Water Resources has assessed as having Extremely High downstream hazard ratings, indicating a risk of considerable loss of human life.
In addition to dams, other elements of water infrastructure, such as levees, are also of concern. Levees face serious threats—from storm surges, sea level rise, and earthquakes—that could cause their failure. Water Resources inspects and reports on observable conditions on certain levees and reviews the status of maintenance practices to ensure that local entities are meeting their legal obligations. 6 Results from Water Resources’ 2022 levee maintenance inspections indicated that local agencies’ maintenance of levees had worsened slightly from the previous year. Water Resources reported that 38 of 106 geographical areas received Unacceptable maintenance ratings, and 33 areas received Minimally Acceptable maintenance ratings. A rating of Unacceptable means that one or more deficient conditions exist that may prevent the project from functioning as designed, intended, or required. A Minimally Acceptable rating means that one or more conditions exist in the flood protection project that needs to be improved or corrected.
Maintenance for levees and flood control is generally conducted by levee districts, reclamation districts, or other public agencies. 7 However, Water Resources inspects levee maintenance for certain levees, and a potential failure of California’s flood control system poses a risk to the State. For example, in 2017 and 2019, many levees sustained storm damage. The State responded by developing a rehabilitation program that, in combination with United State Army Corps of Engineers’ efforts, expedited repair on 105 damaged sites, with 21 remaining to be completed.
Because of the current high risks presented and the inadequate progress to mitigate those risks, the State’s water infrastructure will remain a high-risk issue. The significant number of high-hazard dams with condition ratings below Satisfactory shows that circumstances have not changed substantially enough to meet the requirements of our regulations. Further, the high number of emergency plans yet to be approved by Emergency Services shows that significant corrective action has not yet occurred. Finally, audit work by the State Auditor could assist efforts in mitigating the risk presented by this issue area by examining the State’s process for inspecting dams and approving emergency plans.

Status: Retained on high-risk list​

CalOES' response, California Natural Resources Agency's response, and State Auditor's comments

HEALTH CARE SERVICES HAS NOT ADEQUATELY ADDRESSED ISSUES WITH MEDI-CAL ELIGIBILITY, BUT IT HAS MADE IMPROVEMENTS TO ITS MHSA OVERSIGHT​

Background​

The Department of Health Care Services (Health Care Services) is responsible for overseeing the State’s implementation of the federal Medicaid program, known in California as Medi-Cal. Medi-Cal provides comprehensive health services—including preventive, routine, and emergency care—for eligible residents such as low‑income children, pregnant women, and families, and elderly or disabled individuals. As part of this responsibility, Health Care Services is responsible for ensuring that counties’ determinations of eligibility for applicants are appropriate and completed in a timely manner. Health Care Services’ role is pivotal because erroneous determinations of eligibility result in inappropriate expenditures or in residents’ inability to access needed services.
Our office previously issued Report 2018-603, October 2018, and Report 2019‑002, October 2020, which both identified discrepancies between state and county Medi‑Cal eligibility systems resulting in at least $4 billion in questionable payments. We also found that Health Care Services had not implemented the controls or processes necessary to ensure that problems with Medi‑Cal eligibility are corrected, a process for monitoring county welfare agencies’ progress in addressing eligibility discrepancy alerts. In Report 2020-613, July 2021, we reported that despite the COVID-19 public health emergency, Health Care Services could still do more to address chronic Medi-Cal eligibility problems. In our most recent state high-risk assessment, Report 2021-601, August 2021, we reported that Health Care Services remained a high-risk agency, because it had not corrected discrepancies in its Medi‑Cal eligibility system that had resulted from suspended efforts during the COVID-19 public health emergency and that the problem had continued to grow.
Additionally, since 2012 Health Care Services has been responsible for overseeing various aspects of the Mental Health Services Act (MHSA). In 2004 voters enacted the MHSA, which expanded services and treatment for those who suffer from or are at risk of serious mental illness, and is funded by a 1 percent income tax on personal income in excess of $1 million per year. We have included Health Care Services’ oversight of the MHSA on our state high-risk list since 2007 and have performed two audits related to the MHSA. In Report 2012-122, August 2013, we identified deficiencies in state oversight of the implementation of MHSA funding, including county programs’ inadequate collection of the data necessary to determine the effectiveness of MHSA funds. In Report 2017-117, February 2018, we noted that, despite having had responsibility for the MHSA since 2012, Health Care Services had not developed a process to recover unspent MHSA funds from local mental health agencies. As a result, local agencies had amassed hundreds of millions of dollars in unspent MHSA funds that should otherwise have been reallocated to other local mental health agencies, a process called reversion. We recommended that Health Care Services develop guidance for counties on administering their MHSA programs.

Assessment—Medi-Cal Eligibility​

Although it has made some progress, Health Care Services has not adequately resolved issues involving Medi‑Cal eligibility. In Report 2020-613, July 2021, we found that the number of eligibility discrepancies between state and county eligibility systems increased during the COVID‑19 pandemic and that Health Care Services was not doing enough to resolve eligibility questions about Medi‑Cal beneficiaries. Health Care Services began taking steps in June 2022 to address eligibility discrepancies by issuing guidance to counties on case processing actions after the May 11, 2023, termination of the public health emergency. Health Care Services is developing additional guidance on the prioritization of resolving high-risk eligibility issues and will be monitoring counties’ efforts through its oversight program, which it plans to launch statewide in May 2024. However, to allow counties to complete public health emergency wind-down activities, Health Care Services does not expect to fully implement our July 2021 recommendations regarding eligibility discrepancies until June 2024.
Although Health Care Services is positioning itself to make progress on this issue, we lack assurance that it has resolved issues related to Medi-Cal beneficiary eligibility. Because of the current risks presented and the lack of demonstrated progress, Health Care Services’ management of Medi-Cal benefits will remain a high-risk issue. Finally, audit work by the State Auditor could assist in mitigating the risk presented by this issue area by following up on recommendations from our prior audits, assessing Health Care Services’ progress in addressing ineligible Medi-Cal recipients, and potentially providing further recommendations.

Status: Retained on high-risk list​

Health Care Services response

Assessment—MHSA​

In 2017 the State enacted Assembly Bill 114 to provide counties with a second opportunity to use certain MHSA funds. The amended state law provided that funds subject to reversion as of July 1, 2017, were deemed reverted to the State and reallocated to the county of origin for their originally designated purposes. This effectively provided counties with additional time to spend previously allocated funds. The Legislature also gave small counties—those with fewer than 200,000 residents—two extra years to spend their MHSA funds.
We retained this issue on our high-risk list in August 2021 because Health Care Services had not implemented a sufficient number of our recommendations surrounding this issue to mitigate its risk. However, since that last assessment, Health Care Services has made progress in this area. The department had previously created regulations to improve reporting related to unspent MHSA funds that were subject to reversion. The department reports that it now makes these determinations according to amounts reported by counties in their Annual MHSA Revenue and Expenditure Reports. Health Care Services communicated this process to counties, letting them know that they must generally spend funds allocated to Community Services and Supports, Prevention and Early Intervention, and Innovation components within three fiscal years. In addition, Health Care Services informed counties that they must spend funds allocated to Capital Facilities, Technological Needs, and Workforce Education and Training components within 10 fiscal years.
Our review of submitted MHSA Revenue and Expenditure Reports shows that counties are now using the majority of their MHSA funds within the required timelines. In fiscal year 2021–22, about $5.4 billion was deposited into the MHSA Fund according to the 2023–24 Governor’s budget, and MHSA expenditures amounted to $6.5 billion in that fiscal year. In addition, Health Care Services estimated that $3.5 and $3.4 billion would be deposited into the Mental Health Services fund in fiscal years 2022–23 and 2023–24 respectively and $3.6 and $3.4 billion would be spent in those years. Counties therefore now appear to be spending MHSA funds promptly.
Health Care Services has now fully or partially implemented ten of 11 recommendations from Report 2012-122, August 2013, and six of seven recommendations from Report 2017-117, February 2018. For example, Health Care Services retained a contractor who has provided training and technical assistance to counties.
Although the risk to the State and its residents is serious if Health Care Services mismanages the MHSA, recent legislative changes, combined with the department’s progress in implementing outstanding recommendations, demonstrate that the agency has made sufficient progress toward eliminating the basis upon which we determined that oversight of MHSA funds was high-risk. Therefore, additional audits conducted by the State Auditor would be unlikely to assist in mitigating risks associated with MHSA funds. Accordingly, we are removing Health Care Services’ oversight of the MHSA as a high-risk issue.

Status: Removed from the high-risk list​

Health Care Services response