Skip to statewide header Skip to site header Skip to main content Skip to site footer Skip to statewide footer
California State seal on textured gold background

2025-039 FI$Cal

Letter Report

December 16, 2025
2025-039

The Governor of California
President pro Tempore of the Senate
Speaker of the Assembly
State Capitol
Sacramento, California 95814

Dear Governor and Legislative Leaders:

State law requires our office to monitor and to report annually on the State’s progress in implementing and operating the Financial Information System for California (FI$Cal), a single information technology platform intended to support the financial business of the State by unifying and making transparent and efficient its budgeting, procurement, cash management, and accounting functions. The Department of FISCal operates the system and, in collaboration with its four partner agencies, oversees its ongoing maintenance and improvement.1 Our office’s responsibilities include monitoring and reporting annually on the progress of the Department of FISCal and of one of its partner agencies—the State Controller’s Office (SCO)—as they work jointly to make FI$Cal the State’s accounting book of record for statewide accounting, year-end close processes, and the preparation of financial statements. We are also monitoring the Department of FISCal’s progress in onboarding eight remaining agencies to FI$Cal.

Key Observations

  • There is risk that the SCO may not be able to meet the July 1, 2026 target date related to migrating its book of record functionality to FI$Cal. This functionality is critical because the book of record is the official financial record for the State and includes two components: the accounting book of record, containing daily financial balances and activity, and the reporting book of record, used for the State’s financial statements. As such, the SCO must closely monitor its progress in completing the remaining 62 of 122 requirements it has identified as necessary to complete the migration.
  • Although the Department of FISCal still has eight deferred agencies to onboard to FI$Cal, one agency—the California State Teachers’ Retirement System (CalSTRS)—may not adopt the system. The California Department of Technology (CDT), in consultation with the Department of Finance (DOF) and the Department of FISCal, disagrees with CalSTRS’ assertion that it is constitutionally exempt from using FI$Cal.
  • Although the Department of FISCal is making progress on completing projects for the remaining five roadmap activities established in state law, one roadmap activity—related to supporting the transition of the State’s Accounting Book of Record to FI$Cal—could be at risk of not being completed by the July 1, 2026 target date if the SCO identifies additional requirements.

Background

FI$Cal’s development and implementation began in 2006, and since then more than 150 state entities have implemented FI$Cal, which accounts for 90 percent of the State’s agencies and business units. In 2022, the Legislature declared the objectives for the FI$Cal project to be complete for reporting purposes, which allowed the Department of FISCal to shift its focus from achieving implementation milestones to pursuing ongoing enhancements and improvements. To guide the Department of FISCal’s efforts, state law established for the department six specific categories of work, which the law refers to as roadmap activities. The text box shows the six roadmap activities that the Department of FISCal is responsible for completing. Although the law requires the Department of FISCal to complete all six of these roadmap activities on or before July 1, 2032 unless otherwise specified, four of them—Security, Technical Optimization, Partner Priorities and Additional Products, and System Enhancements and Upgrades—will continue as part of the department’s ongoing mission. We discuss all of the roadmap activities and some of their related criteria and tasks in the final section of this report; however, the two activities with scheduled completion dates are of particular importance to our office’s monitoring responsibility. Roadmap Activity 4 requires the Department of FISCal and the SCO to support the transition of the State’s central accounts for financial reporting—the accounting book of record—from the SCO’s legacy system to FI$Cal. To achieve this transition by July 1, 2026, a target date established in state law, the Department of FISCal and the SCO must each complete an extensive list of tasks. Roadmap Activity 2 requires the Department of FISCal to continue onboarding activities for the eight agencies that are required to but have not yet transitioned to FI$Cal (deferred agencies).2 These deferred agencies include some of the State’s largest and most complex, and their transition to FI$Cal must be complete by July 1, 2032.

Department of FISCal Roadmap Activities

State law provides that, unless otherwise specified, the department shall complete all of the following roadmap activities on or before July 1, 2032:

  1. Ensure that the system is technically optimized and secure according to industry best practices.
  2. Onboard the remaining deferred agencies and be sufficiently staffed to provide ongoing support and assistance to end users.
  3. Ensure the integrity and security of the State’s financial data.
  4. Support the transition of the State’s accounting book of record from the SCO’s legacy systems to FI$Cal, including validation work related to the Annual Comprehensive Financial Report.
  5. Work with partner agencies to identify and implement additional products, interfaces, and add-ons to the system to enhance business transactions.
  6. Continue to enhance, upgrade, and manage the system to ensure efficient and relevant alignment with the State’s financial management processes.

Source: State law.

The SCO Must Implement 122 Requirements Before July 2026 to Meet Its Target Date to Move the State’s Book of Record to FI$Cal

State law directs the Department of FISCal and the SCO to complete the migration of the SCO’s book of record to FI$Cal. The book of record is the official financial record for the State and includes two primary components: the accounting book of record, which contains daily financial balances and activity, and the reporting book of record, which is used for the State’s financial statements. In December 2023, the SCO submitted to the Joint Legislative Budget Committee a high-level timeline and a list of 150 requirements it believed at the time were necessary for it to complete the migration of the SCO’s book of record functionality to FI$Cal by July 1, 2026. The SCO has since revised and decreased the number of requirements, and it may continue to adjust the requirements’ necessity or priority. As of November 2025, the list stands at 122 requirements that the SCO believes it currently needs to complete to ensure the migration of its book of record functionality to FI$Cal by the planned target date.3

We asked the SCO to identify which of these 122 requirements are the most critical for ensuring that it can complete the migration of the book of record as planned. However, the SCO’s acting FI$Cal division chief stated that all requirements are necessary for the book of record transition. She further explained that the requirements are not interdependent, and the order in which they are released does not affect the SCO’s schedule, as long as all the requirements are completed and released by the July 1, 2026 target date. This approach allows the SCO to monitor progress throughout the period between completion and release milestones. The SCO and the Department of FISCal use the Agile development approach, which includes short development lifecycles, also known as sprints, for each deliverable or requirement, repeated over the course of the project. Through this approach, the development teams regularly review projects and refine them during execution as more detailed and specific information and more accurate estimates become available. Although the SCO has identified the number of requirements and developed a schedule for starting and implementing each requirement, the Agile development approach allows for flexibility and change to minimize any impact on the overall project scope—the work specifications related to the project—and target date.

Although the SCO believes that it is on track to complete all 122 requirements by the July 1, 2026 target date, there is a risk that it may not complete all requirements by this date. In our November 2024 report, we noted that the SCO had completed seven requirements. As of November 2025, the SCO completed 53 additional requirements for a total of 60 completed requirements, as Figure 1 shows. There are 56 other requirements that are in progress. According to SCO’s schedule and documentation, of these 56 requirements, five are ahead of schedule and 32 are on track to deploy by the planned target date. The remaining 19 requirements that are in progress are behind schedule by approximately one to seven months. Further, the SCO has not started six requirements, which are scheduled to begin between December 2025 and April 2026. The SCO has taken steps to mitigate delays and ensure that requirements that are behind schedule or not yet started deploy by the planned target date. Despite these efforts, given that the SCO has missed scheduled completion dates for some of the requirements, it may face unknown challenges that could arise for requirements it has not yet started. With the fast‑approaching target date for completing all requirements, there is a risk that the SCO may not complete all requirements by the target date, as Figure 2 shows.

Figure 1
The SCO’s Progress Toward Achieving Migration to FI$Cal

A graphic showing the SCO’s progress on completing 122 requirements to migrate its book of record to FI$Cal by the target date.

Source:  State Auditor’s review of documents provided by the SCO.

Number and Percentage of Requirements at Each Stage of Completion
The accounting and reporting book of record includes 122 requirements. Of these, 60 (49 percent) are complete, six (five percent) have not yet started, and 56 (46 percent) are in progress. Among the 56 requirements in progress, five are ahead of schedule, 32 are on track to deploy by the planned target date, and 19 are behind schedule.

Figure 2
Several of the SCO’s Accounting and Reporting Book of Record Requirements Are Behind Schedule

A graphic showing 19 accounting and reporting books of record requirements that are behind schedule and at risk of missing the target completion date.

Source:  State Auditor’s review of documents provided by the SCO.

Many of the 19 requirements behind schedule were originally scheduled for completion in September, October, or November 2025. The SCO’s revised schedule projects their completion between December 2025 and April 2026. Because of the SCO’s revised timeline, there is a higher risk that the SCO may not complete all requirements by the target date, July 1, 2026..

The delays in completing the 19 requirements that are currently in progress are mainly due to fixing issues found during user testing, adding new features requested by stakeholders, and the functionality taking longer to build than expected. For example, according to the SCO, one requirement is about seven months behind schedule because several issues were discovered during user testing, a process in which stakeholders test a feature to ensure it operates as expected. Stakeholders provided feedback and requested changes, which required additional time to conduct a second demonstration to review the updates. Additional user testing, the final stage for this requirement, is currently underway and is expected to be completed by early December 2025 to be ready for deployment by the July 1, 2026 target date. The SCO plans to make some timeline adjustments for this requirement to reduce the delay. Of the 19 delayed requirements, the SCO plans to make minor timeline adjustments to 11 of the requirements and expects them to be completed by early January 2026.

The eight remaining delayed requirements will require more substantial timeline changes, which places the SCO at risk of missing the planned target date. Our review shows that these eight requirements are currently behind schedule by approximately one to four months. For example, one requirement, to prevent automatically posting certain appropriations that require manual review, was originally scheduled to deploy in July 2025. However, this requirement was delayed because the functionality was complex, the available design documents lacked sufficient technical details, and the team’s detailed analysis was delayed due to other competing priorities. The SCO initially adjusted the completion date to October 2025. However, as of November 2025 this requirement has still not been completed because work on a different requirement needed to be completed before staff could work on this requirement. The SCO plans to update the timeline again, setting a new completion date of no later than the end of March 2026 to be ready for deployment by July 1, 2026, nearly a year beyond its original planned deployment date. The SCO explained that the conflict that has been causing delays should resolve soon and that it plans to reduce validation testing conflicts or delays by completing the testing in smaller segments across four months.

The SCO indicated that the other seven requirements are behind schedule for various reasons. For instance, one requirement—related to a module that monitors statewide loans—supports the SCO’s daily operations and reconciliation of statewide loans by providing summarized reports of loan transactions. This requirement did not meet the necessary conditions during testing, leading to new, additional tasks to meet the business needs of the user. Another requirement is to create an integration point that enables FI$Cal and the SCO’s local government programs and services legacy systems to exchange budget attribute data such as Business Unit, Fund, and Year of Enactment. This data transfer is necessary for the legacy systems to continue processing payments to local entities. Although the integration point was originally included in the scope of work for this requirement, it was removed during stakeholder validation. However, subsequent user testing later demonstrated the necessity of the integration point, which extended the schedule and delayed the planned deployment for this requirement.

To ensure these eight requirements deploy by the planned target date, the SCO is developing a change request—a formal process to modify a requirement’s scope, schedule, or resources. If the change request significantly impacts the schedule, scope, or cost, the SCO’s and Department of FISCal’s book of record functionality migration program leadership team will review and approve it through a governance process. According to the SCO, the schedule change will allow improved tracking of design, development and implementation work related to all current staff activities required through July 1, 2026, including regression testing and other readiness or cutover activities. For instance, this change request will mitigate schedule risks while allowing the SCO project managers to effectively manage staff resources and capacity on a month-to-month basis. The SCO stated it plans to submit and obtain approval of the change request by early December 2025.

Finally, of the six requirements that have yet to start, three are planned to begin in late April 2026—about two months before the target date, as Figure 3 shows. We asked the SCO whether it believes completing these requirements is feasible within this timeline. The SCO indicated that the tasks required to complete four of the six requirements do not involve time-intensive efforts, such as developing software features or conducting user testing; instead, they relate to administrative tasks such as updating business processes and training documentation. Further, the SCO explained it has completed initial planning and analysis for the two remaining requirements. Therefore, the SCO believes it can complete all of these requirements by the planned target date. However, considering the delays that the SCO has experienced in trying to complete the various requirements, and recognizing that unforeseen challenges may arise once work begins on these six requirements, regardless of how much information is known in advance, there is a risk that the SCO may not be able to complete all requirements in the next seven months to meet the July 1, 2026 target date. Therefore, it is critical that the SCO continue to closely monitor the progress of all 62 remaining requirements.

Figure 3
Several of the SCO’s Accounting Book of Record Requirements Have Not Started

A graphic showing six accounting book of record requirements that have yet to start and are at risk of missing the target completion date.

Source:  State Auditor’s review of documents provided by the SCO.

The SCO plans to complete two requirements by April 2026, and three additional requirements are expected to begin in late April 2026—about two months before the target date. The remaining requirement is planned for completion by June 2026. Because these six requirements are scheduled to begin between December 2025 and April 2026, there is a higher risk that the SCO may not complete all requirements by the target date, July 1, 2026.

The Department of FISCal Has Made Some Progress Toward Completing the Roadmap Activities Established in State Law

As we discussed earlier, in addition to requiring the SCO to take steps to complete the migration of the State’s accounting book of record to FI$Cal, state law requires the Department of FISCal to complete its roadmap activities by July 1, 2032. Although the law includes some general criteria—such as industry best practices and desired outcomes—for the roadmap activities, it does not direct the Department of FISCal on how to complete each activity or include specific criteria the department should use to gauge its success. Therefore, it is incumbent upon the Department of FISCal to identify the scope of actions it must take to be successful in its roadmap activities and define the criteria it will use to know if it is successful.

The Department of FISCal has identified from three to 13 separate projects within each of the six roadmap activities—a total of 51 projects—and has developed a 10-year strategic plan to guide its successful completion of all 51 projects and the six roadmap activities by July 1, 2032.4 According to its schedule, the department completed seven projects since our last report, for a total of 17 completed projects. It currently has 19 projects that are in progress and plans to complete seven of these projects by the end of December 2025. Thirteen more projects have not started and are scheduled to begin between January 2026 and July 2029, as Figure 4 shows. Finally, two projects are on hold—the Department of FISCal is finalizing project details with the SCO to resume work on one project, and the department may face some challenges with another project that involves onboarding CalSTRS. We discuss the roadmap activities and these projects in additional detail below.

Figure 4
The Department of FISCal’s Progress on Six Roadmap Activities

Source: State Auditor’s review of documents provided by the Department of FISCal.

* These roadmap activities are ongoing maintenance and operations activities.

Roadmap Activity 4—SCO Book of Record Support and Validation: This Roadmap Activity includes seven projects. Three are in progress, three are complete. One project remains, with target start date of January 1, 2026 and completion date of December 31, 2026.
Roadmap Activity 2 – Onboarding and Support: This Roadmap Activity includes 12 projects. One is on hold, three are in progress, and two are complete. Six projects remain, with target start date of July 1, 2026 and completion date of June 30, 2032.
Roadmap Activity 3 – Security: This Roadmap Activity has three projects. One is in progress and two are complete.
Roadmap Activity 1 – Technical Optimization: This Roadmap Activity includes seven projects. One is in progress and two are complete. Four projects remain, with target start date of January 1, 2026 and completion date of June 30, 2031.
Roadmap Activity 5 – Partner Priorities and Additional Products: This Roadmap Activity includes nine projects. One is on hold, four are in progress, and four are complete.
Roadmap Activity 6 – System Enhancements and Upgrades: This Roadmap Activity includes thirteen projects. Severn are in progress and four are complete. Two projects remain, with target start date of July 1, 2026 and completion date of December 31, 2027.

Roadmap Activity 4:
Support the Transition of the State’s Accounting Book of Record to FI$Cal

Although the Department of FISCal has made progress on most projects for this roadmap activity, there is a risk that two projects directly related to the SCO’s 122 requirements we discussed earlier may not be completed before the July 1, 2026 target date. The department has identified seven projects for this roadmap activity. Three projects are complete, and one is scheduled to start January 2026, with completion expected by the end of 2026. Currently, three projects are in progress, one of which is on track and expected to be complete by late January 2027. Two projects in progress are directly related to the SCO’s 122 requirements it needs to complete to ensure the migration of its book of record functionality to FI$Cal by July 1, 2026. Specifically, the Department of FISCal is responsible for building the functionality identified by the SCO for the 122 requirements. Further, after the SCO completes user testing, the Department of FISCal is responsible for implementing those functionalities. As we described earlier, there is a risk that the SCO may not complete all 122 requirements by the July 1, 2026 target date. The Department of FISCal staff claims that it has developed a schedule that allows adequate time for SCO’s user testing of complex business processes such as investment accounting and loan accounting while allowing the project team to evaluate, prioritize, and address any additional identified scope through the governance and project management processes.

However, the Department of FISCal acknowledged that there is a risk that a discovery of additional scope, such as new tasks necessary to meet user business needs, during user testing could lead to unanticipated work and potentially impact the schedule.

Roadmap Activity 2:
Onboarding the Remaining Deferred Agencies

Although the Department of FISCal believes that it is on track to onboard all deferred agencies by the July 1, 2032 deadline, it may face some challenges in doing so.5 The department has identified 12 projects for the onboarding roadmap activity—10 related to onboarding the 10 initially deferred agencies; one related to working with the deferred agencies on their gap analyses; and one related to how those agencies that are not fully onboarded to FI$Cal will interface their existing agency system with FI$Cal after the SCO migrates its book of record functionality to FI$Cal by the target date July 1, 2026. In our November 2024 report, we noted that the Department of FISCal completed two projects by onboarding two state agencies—the Department of Rehabilitation (Rehabilitation) and the CDT. The Department of FISCal has not onboarded additional deferred agencies since our last review. Although the gap analyses for seven of the remaining eight deferred agencies have been completed, CalSTRS believes that the California Constitution makes it exempt from using FI$Cal and that a gap analysis is, therefore, unnecessary. As such, this project is currently on hold. Unless the Department of FISCal resolves this disagreement with CalSTRS, there is a risk that the department may not meet the July 1, 2032 deadline for this roadmap activity.

The Department of FISCal is in the process of onboarding two agencies. Although the Department of FISCal expected to complete onboarding for the California Department of Transportation (CalTrans) by June 2026, in September 2025 the CDT, in consultation with the DOF and the Department of FISCal, conditionally approved a continued deferral for CalTrans to implement FI$Cal by July 2028. The deferral was approved under five conditions. For example, one condition requires the Department of FISCal and CalTrans to work diligently and cooperatively to complete the design, build, and testing of solutions for all currently identified gaps by July 2026. The Department of FISCal indicates that both parties are developing a plan to address these five conditions, with the plan expected to be finalized by December 2025. Further, the Department of FISCal started onboarding the California Department of Justice (DOJ) and expects to complete it by June 2027, as Figure 5 shows.

Figure 5
Status of the Deferred Agencies’ Onboarding to FI$Cal

A graphic showing the onboarding status of 10 deferred agencies to FI$Cal.

Source: FI$Cal strategic roadmap.

* Completion date has been updated from June 30, 2026 to July 1, 2028, based on CDT’s response to CalTrans’ request for exemption.

The California Department of Technology and the Department of Rehabilitation completed their onboarding to FI$Cal on June 30, 2024.
The California Department of Transportation has completed a gap analysis and is on schedule to complete onboarding to FI$Cal by July 1, 2028. The completion date was updated from June 30, 2026 to July 1, 2028, based on the California Department of Technology’s response to the California Department of Transportation’s request for exemption.
The Department of Justice has completed a gap analysis and is on schedule to complete onboarding to FI$Cal by June 30, 2027.
The California Prison Industry Authority has completed a gap analysis and plans to onboard to FI$Cal with a target start date of July 1, 2026, and target completion date of June 30, 2029.
The California Department of Corrections and Rehabilitation has completed a gap analysis and plans to onboard to FI$Cal with a target start date of July 1, 2027, and target completion date of June 30, 2030.
The California State Teachers’ Retirement System’s gap analysis is on hold and plans to onboard to FI$Cal with a target start date of July 1, 2028, and target completion date of June 30, 2030.
The California State Lottery Commission has completed a gap analysis and plans to onboard to FI$Cal with a target start date of July 1, 2028, and target completion date of June 30, 2030.
The California Department of Water Resources has completed a gap analysis and plans to onboard to FI$Cal with a target start date of July 1, 2029, and target completion date of June 30, 2032.
The California Department of Motor Vehicles has completed a gap analysis and plans to onboard to FI$Cal with a target start date of July 1, 2029, and target completion date of June 30, 2032.

For the remaining six deferred agencies, the Department of FISCal has not started the onboarding process. One reason the process has not started at these agencies is that the Department of FISCal requires each agency to conduct a gap analysis, which involves reviewing each agency’s processes and information systems and identifying any high‑level gaps that may exist between the agency’s business processes and FI$Cal. Five of these six agencies—California Prison Industry Authority (CALPIA), California State Lottery Commission (Lottery Commission), California Department of Corrections and Rehabilitation (CDCR), California Department of Water Resources (DWR), and California Department of Motor Vehicles (DMV)—have each now completed their gap analysis. These five agencies are scheduled to begin onboarding between July 2026 and July 2029 and are currently scheduled to complete onboarding at various times between June 2029 and June 2032, as Figure 5 shows.

Although the Department of FISCal states that the remaining deferred agencies are on schedule to complete onboarding to FI$Cal by 2032, the size and complexity of some of those agencies could hinder the Department of FISCal’s ability to meet that deadline. The Department of FISCal’s 2023 State Leadership Accountability Act report identified several external factors that contribute to the risk of the deferred agencies not transitioning to FI$Cal before the July 1, 2032, deadline. Specifically, the agencies’ varied priorities and existing workload, extensions to their legacy systems’ end-of-life timelines, and the timely acquisition of necessary resources and approvals for additional resources can independently or collectively impair the department’s efforts to meet the statutory deadline. It is critical that the Department of FISCal monitor whether it has sufficient resources to support transition of the deferred agencies, which include some of the largest or those with the most complex needs in the State, such as CALPIA, CDCR, DWR, and DMV.

Moreover, as we noted above, the Department of FISCal is facing a potential hurdle with onboarding the sixth deferred agency, CalSTRS, to FI$Cal. Specifically, in July 2024 CalSTRS submitted a request to CDT for full exemption from FI$Cal. In November 2024, CDT, in coordination with the DOF and the Department of FISCal, reviewed and determined that CalSTRS has partial exemption from FI$Cal for financial retirement and investment functions but stated that laws referenced in the request did not support a full exemption. CDT indicated that CalSTRS must collaborate with the Department of FISCal to complete a gap analysis by June 30, 2025, after which CalSTRS could resubmit its exemption request, if warranted. CDT stated in its determination that it will, in consultation with the DOF and the Department of FISCal, re-evaluate any future request based on the gap analysis results and cost implications of viable alternatives. In January 2025, CalSTRS contested CDT’s decision, arguing that the California Constitution assigns CalSTRS’ board plenary authority in the administration of its system, thereby providing CalSTRS with full exemption. According to CalSTRS, this authority is the same reason that the California Public Employees’ Retirement System is exempt from using FI$Cal. As a result, CalSTRS stated that it does not agree to perform a gap analysis for a system it believes it cannot use because it would constitute an unauthorized expenditure of resources. To resolve this issue, the Department of FISCal indicated that by the end of 2025, CDT, in consultation with the DOF and the Department of FISCal, should first respond to CalSTRS’ letter, and then the Department of FISCal should schedule a gap analysis with CalSTRS. We believe it is important for the Department of FISCal to obtain an independent legal opinion regarding whether CalSTRS is legally exempt from the requirement to use FI$Cal. This opinion would help clarify the issue, prevent further delays, and avoid spending state resources on actions that may not be necessary.

Roadmap Activity 3:
Ensure the Integrity and Security of the State’s Financial Data

The Department of FISCal is on track to complete this roadmap activity before the deadline. Specifically, it has identified three projects related to the security roadmap activity. In our November 2024 report we stated that the Department of FISCal had completed one project in April 2024 and had two projects remaining that related to the State’s Cal-Secure Strategic Plan. As we described in our November 2024 report, the Cal-Secure Strategic Plan—the State’s multiyear information security maturity roadmap issued in 2021—consists of 29 technical capabilities that state entities must adopt and achieve in order of priority, 27 of which are applicable to the Department of FISCal. In June 2025, the Department of FISCal completed its second project, which encompassed phases one, two, and three of the Cal-Secure Strategic Plan. The third project, which relates to phases four and five of the Cal-Secure Strategic Plan, is in progress and on track for completion in December 2025. Currently, the Department of FISCal has 26 of the 27 applicable technical capabilities in place, and the remaining capability is in progress. The chief deputy director explained that the department’s ability to obtain the necessary technology has delayed the process; nevertheless, he anticipates that the final capability will be implemented by the December 31, 2025 target deadline.

In addition to fulfilling the requirements in Cal-Secure, the Department of FISCal ensures the integrity and security of the State’s financial data by following and implementing the requirements set forth in the State Administrative Manual (SAM) and the Statewide Information Management Manual. State policy presented in SAM requires the Department of FISCal to develop and maintain a Register and Plan of Action and Milestones (POAM) process for addressing information security program deficiencies.6 State entities are obligated to report updated POAMs quarterly to the CDT’s Office of Information Security. In the POAM, the Department of FISCal records security risks found by internal observation and by audits conducted by CDT, the California Military Department, and our office, and assigns each risk a rating. The number of open risks can change over time, as new risks are identified and the department addresses old ones. In our November 2024 report, we noted that the Department of FISCal had 60 open risks, which it planned to address within 12 months.

As of October 2025, the latest POAM shows that the Department of FISCal resolved 59 of the 60 open risks from our previous report and added 23 new risks, for a total of 24 open risks that it continues to address. We purposefully do not discuss risks related to missing and incomplete information technology (IT) security programs so as not to potentially compromise FI$Cal. According to the POAM, the Department of FISCal plans to address all 24 open risks between January 2026 and December 2027.

Roadmap Activities 1, 5, and 6:
Ensure Technical Optimization; Work With Partner Agencies to Identify Priorities and Implement Additional Products; and Continue to Enhance, Upgrade, and Manage the System

The Department of FISCal has progressed as planned since our last review and expects to complete all projects by the June 2032 deadline. Due to the ongoing nature of these roadmap activities, we noted that it was likely that the Department of FISCal will add and remove projects related to each activity over time. In April 2025, the Department of FISCal divided an existing partner priority project into two projects, increasing the total number of projects to 29. Specifically, the Department of FISCal split the Electronic Invoicing project into Electronic Invoicing Implementation and Electronic Invoicing Rollout projects. The Electronic Invoicing Rollout project tracks the rollout of the associated Electronic Invoicing Implementation project for each agency that uses FI$Cal. As of November 2025, the Department of FISCal completed 10 projects, has 12 projects that are in progress, and the remaining seven either have not started or are on hold.

As we reported in November 2024, the Department of FISCal had completed six projects, and nine projects were in progress and scheduled for completion between December 2024 and December 2025.7 In 2025, the Department of FISCal split one of these nine projects into two projects for a total of 10 projects that were in progress. As of November 2025, the Department of FISCal completed four of these 10 projects and expects to complete five additional projects by the end of December 2025, as planned. We found that one of the five projects is complete, but the department is keeping it open to allow agencies to submit additional enhancement requests for the application through the end of December 2025. The remaining four projects are between 79 and 98 percent complete as of November 2025. One other project originally scheduled for completion by the end December 2025, will be extended to incorporate newly available technology. The Department of FISCal plans to submit and obtain approval of a change request to extend the project’s completion by two or three months, and expects to finalize the project schedule by December 12, 2025.

Further, the Department of FISCal started working on five additional projects, including one that was previously placed on hold, since our last review. The status of these five projects ranges from the initiation phase—defining the project scope, developing a schedule, and assessing resource requirements—to nearly complete. For example, one project that focuses on enhancements and upgrades began in July 2025 and is currently in the initiation phase with an end-of-year 2025 target to finalize the project scope. The Department of FISCal expects to complete all five of these projects between December 2025 and December 2027, finishing well before the July 1, 2032 deadline.

We noted in our November 2024 report that the Department of FISCal had two partner priority projects on hold while the entities sponsoring those projects worked to finalize the project details. In February 2025, the Department of FISCal resumed work on the eMarketplace project—a modern statewide procurement platform providing easy access to IT, non-IT goods, and IT services contracts—after the Department of General Services procured the technology required for the project and selected an implementation vendor. The project is on track for its target completion date in June 2026. Although another project—the California State Payroll System project—is still on hold, according to the Department of FISCal, the SCO has executed a vendor contract for this project and is working to finalize project details so that the Department of FISCal can resume work on the project.

The Department of FISCal also has one ongoing project related to production enhancements. The Department of FISCal set a goal to deliver at least 80 enhancements each year under this project. In 2025, the Department of FISCal selected 97 enhancements to deliver and, as of November 2025, it has delivered 70 enhancements and expects to deliver 19 additional enhancements by the end of December 2025, for a total of 89, thereby meeting its annual goal. However, the department expects that this project will continue even after FI$Cal is fully implemented. As such, this project is expected to remain in progress for the foreseeable future.

Recommendation

To ensure that it resolves the disagreement with CalSTRS regarding CalSTRS’ status, the Department of FISCal, in consultation with CDT and CalSTRS, should obtain an independent written legal opinion on whether CalSTRS is constitutionally exempt from using FI$Cal.8

We prepared this report pursuant to Government Code section 11868.

Respectfully submitted,

GRANT PARKS
California State Auditor

For questions regarding the contents of this report, please contact our Communications Office at 916.445.0255.

Staff:
Kris D. Patel, Audit Principal
Shawn Butler
Angelica Thompson

Legal Counsel:
Joe Porche

Response to the Audit

Department of FISCal

December 4, 2025

Grant Parks
California State Auditor
621 Capitol Mall, Suite 1200
Sacramento, CA 95814

RE: FI$Cal response to CSA Report 2025-039

Dear Mr. Parks:

FI$Cal will work with CDT, in consultation with the Department of Finance, to assist CDT in responding to CalSTRS’ January 2025 letter to CDT contesting CDT’s decision that CalSTRS is not fully exempt from FI$Cal.

Sincerely,

Bret Ladine
Director
Department of FISCal

Footnotes

  1. The four partner agencies that work to support the project and achieve FI$Cal’s objectives are the Department of Finance, the Department of General Services, the State Controller’s Office, and the State Treasurer’s Office. ↩︎
  2. The California Department of Transportation, the California Department of Justice, the Prison Industry Authority, the California State Teachers’ Retirement System, the California State Lottery Commission, the California Department of Corrections and Rehabilitation, the Department of Water Resources, and the Department of Motor Vehicles. ↩︎
  3. In our letter report 2024-039, issued in November 2024, the SCO identified 121 requirements it believed were necessary to complete the migration of its book of record functionality to FI$Cal. In June 2025, the SCO determined that one additional requirement, originally scheduled to deploy in January 2027, was necessary to meet the planned migration target date. As a result, the total number of requirements increased from 121 to 122. ↩︎
  4. In our letter report 2024-039, issued in November 2024, the Department of FISCal identified 50 projects necessary to complete the six roadmap activities. In April 2025, the Department of FISCal divided an existing partner priority project into two projects. We discuss this new project in more detail in the final section of the report. As a result, the total number of projects increased from 50 to 51. ↩︎
  5. In addition to the deferred agencies, the Department of FISCal has designated eight state agencies as exempt from the requirement to transition to FI$Cal. These include the California Finance Housing Agency, the University of California, the California State University, the Public Employees’ Retirement System, the State Compensation Insurance Fund, the California Law Revision Commission, the Enhanced Tobacco Settlement Asset‑Backed Bonds, and the Legislative Counsel Bureau. The California State Auditor is also exempt but chose to transition to FI$Cal in 2025. ↩︎
  6. State entities report security weaknesses or noncompliance, identified by risk level and remediation status, through POAMs. ↩︎
  7. In our November 2024 report, we noted that the Department of FISCal had 10 projects in progress, but one of these 10 projects—production enhancements—was an ongoing activity and therefore was not included in our total. ↩︎
  8. The Department of FISCal’s response is at the end of this report. ↩︎

Opens in new window