CalPERS Risk & Audit Committee approves 2025–26 compliance and audit plans; retirees urge extended credit monitoring after 2023 breach

The California Public Employees’ Retirement System Risk & Audit Committee on June 17 approved the enterprise compliance risk and governance annual plan, the Office of Audit Services (OAS) audit plan, and the board’s independent auditor plan for fiscal year 2025–26.

Committee members voted by acclamation or unanimous roll call on the three agenda action items after staff presentations and brief question-and-answer exchanges. Committee members also heard multiple public comments urging the system to extend free Experian credit monitoring for retirees impacted by CalPERS’ May 2023 data breach.

Kevin Fine, CalPERS chief compliance officer, presented the enterprise compliance risk and governance (ECRG) annual plan, saying the multi‑year program will continue maturing CalPERS’ compliance work across “people, processes and technology,” expand use of a governance risk and compliance (GRC) platform, formalize regulatory change processes and enhance assurance and monitoring activities. He told trustees the RFP for the board’s next independent auditor was issued May 20, 2025, and that written responses to proposers’ questions would be posted June 20 and proposals are due July 7, 2025.

The committee voted to approve the ECRG annual plan (agenda item 5A) by acclamation during the meeting. Belize Chippoui of the Office of Audit Services then presented the OAS risk‑based internal audit plan, describing the methodology — executive and senior management interviews, board surveys, and coordination with ECRG — and described a four‑cycle employer compliance review using data analytics to select agencies. The committee approved the OAS plan (agenda item 5B) with a motion recorded by Trustee Jose Luis Pacheco and seconded by Trustee Frank Ruffino; the motion passed unanimously.

The committee also heard BDO, the board’s external auditor, outline its annual independent audit approach for CalPERS’ June 30, 2025 financial statements. Billy Kim, BDO principal, and colleagues described significant audit risk areas — management override of controls, valuation of investments and valuation of long‑term care liabilities — and described planned procedures, including confirmations with custodians, testing of journal entries and actuarial review. The committee approved BDO’s audit plan (agenda item 5C) by motion from Trustee Jose Luis Pacheco and second by Vice Chair David Miller; the motion passed unanimously.

Public comment focused heavily on the May 2023 data breach affecting roughly 769,000 retirees and inactive members. Margaret Brown, president of the Retired Public Employees Association of California (RPEA), urged CalPERS to continue Experian credit monitoring "because the risks to our identities didn't end when the headlines faded." Several other RPEA representatives and retirees echoed that request, describing confusing breach notices and the lifetime risk of identity theft.

CalPERS staff acknowledged the comments and said they would evaluate options, including discussions with Experian about continued coverage and discounted rates. The committee did not take formal action on the public‑comment request; staff said the matter is under advisement.

Why this matters: The plans approved by the committee set internal audit and compliance priorities for the coming fiscal year and guide external audit work that underpins the system’s audited financial statements. The public comments underscore ongoing member concern about data security and the operational and reputational implications of vendor breaches.

What’s next: CalPERS staff said responses to the independent auditor RFP will be evaluated after the July 7 deadline, and a recommended firm is expected to come to the Board of Administration later in 2025. Staff also said they will follow up on the Experian requests and report back to the board.