Report 2025-601 State High Risk Audit Program, Audit Plan: January 2026 through December 2027

In accordance with the state high-risk government agency audit program regulations, we present a tentative two-year plan for performing audits and conducting other monitoring activities. The plan covers work from January 2026 through December 2027 regarding state agencies and statewide issues appearing on this state high risk list. The plan is tentative, as such audits and monitoring are subject to resource availability based on our office’s projected workload.

Back to audit report

High Risk Issue or Agency	Summary of Concerns	Planned Approach
Employment Development Department (EDD)	EDD continues to be a high‑risk agency because of insufficient improvement in managing its UI program. EDD continues to have high rates of improper UI payments, including fraudulent payments, and it needs to improve the customer service it provides to UI claimants. EDD also needs to take steps to ensure that its eligibility decisions are not frequently overturned on appeal. Although it has made efforts in these areas, in its 2025 assessment, EDD failed to meet acceptable levels in more than half of the measures on which the federal government evaluates its performance. These inadequacies have resulted in a substantial risk of serious detriment to the State and its residents.	We will continue to monitor EDD, including its implementation of its UI program, and anticipate conducting a follow-up audit as resources allow beginning in 2026.
Department of Social Services	Due to federal changes to the SNAP program, California may soon be responsible for a portion of the cost of the CalFresh program, totaling approximately $2.5 billion. The amount that California will have to pay depends on its payment error rate, the rate at which Social Services issues over or underpayments to beneficiaries. If Social Services does not reduce its payment error rate, California risks adding to its already growing budget deficit.	We will continue to monitor Social Services’ payment error rate and its efforts to reduce the rate and will consider conducting an audit as resources allow.
State’s Management of Federal COVID‑19 Funds	Although most of the federal awards to the State have now expired or been spent, the remaining $2 billion is still a significant amount for the State to manage. The State risks not being able to fully spend these awards before they expire. Further, audits that our office and Finance previously performed resulted in a significant number of findings that state departments and their subrecipients had not managed funds according to federal and state requirements, and Finance and our office have not audited many of the programs with remaining funds.	We previously performed 11 state high-risk audits of agencies and programs that received a substantial influx of funding. Because 20 of the 85 recommendations we made among the 11 audits remain unimplemented, we will continue to monitor the audited entities’ implementation of our recommendations from those reports and will also monitor overall COVID-19 federal spending through our financial and federal compliance audits.
State’s Financial Reporting and Accountability	The State’s financial statements for fiscal year 2021–22, 2022-23, and 2023-24 were issued late. This continued trend of late reporting reduces the efficiency and effectiveness of the State’s financial oversight. Additionally, late financial reporting could negatively affect the State’s credit rating.	To ensure objectivity give the State Auditor’s role in this process, our office has contracted with an outside auditing firm to conduct an audit of this high-risk issue, which is currently underway and is expected to be released in Winter 2026.
Department of Health Care Services (Health Care Services)	Although it has made some progress since our last assessment, Health Care Services has not adequately resolved problems involving Medi‑Cal eligibility and will remain on the state high‑risk list. As of April 2025, the number of eligibility discrepancies between the county and state eligibility systems remains only somewhat below the level that we identified in 2021 that was estimated to have caused the State to disburse $1.9 billion in questionable payments. Additionally, as we have previously reported, Health Care Services may also deny benefits to individuals who may be entitled to receive them. The large number of eligibility discrepancies continues to present a substantial risk of serious financial detriment to the State, as well as to some Californians seeking healthcare services.	We are currently conducting a State High-Risk audit of Heath Care Services, and anticipate reporting the results of this audit in Spring 2026.
Information Security	Although the Department of Technology (Technology) has increased its capacity to conduct compliance audits, reporting entities’ cybersecurity maturity continues to be below the state standard and many nonreporting entities are not complying with cybersecurity requirements; therefore, we will retain information security on the state high‑risk list.	We will continue to monitor Technology’s oversight of information security and will consider conducting a follow-up audit as resources allow.
Water Infrastructure and Availability	Dam conditions have worsened, and emergency planning to address the potential loss of life and potential property damage of a dam failure remains incomplete. Two-thirds of levees that Water Resources inspects are in less than acceptable condition. Additionally, the still-pending Delta Conveyance Project and the ongoing Water Supply Strategy indicate that water availability continues to be a concern.	We are currently conducting a State High-Risk audit of Water Infrastructure, and anticipate reporting the results of this audit in Summer 2026. We also will continue to monitor Water Resource’s implementation of its Water Supply Strategy.
IT Oversight	Since our last state high-risk assessment in August 2023, Technology has implemented changes to improve the PAL process. However, PAL remains a protracted stage of IT project development that can delay project execution. These delays pose a risk of impairing the delivery of important government services. Further, Technology plans to implement PDL as a replacement to PAL in July 2026, but does not yet have outcomes to support success of the new project approval process.	We will continue to monitor Technology’s efforts to oversee IT projects, including its implementation of PDL, and will consider conducting an audit as resources allow.