Oregon Department of Revenue details internal controls for $45 billion in collections

SALEM, Ore. — At an informational hearing May 8, 2025, the General Government Subcommittee of the Ways and Means Committee heard how the Oregon Department of Revenue (DOR) protects taxpayer information and the roughly $45 billion it collected in the last biennium.

DOR Director Betsy Eimholt told the committee the agency relies on policies, employee screening, training, technical safeguards and regular audits to reduce the risk that confidential return data or funds could be improperly accessed or diverted. “If we lose that trust, our very mission is at risk,” Eimholt said.

The presentation described a layered control framework the agency follows. Jay Messenger, DOR’s internal controls officer, said the department follows the Oregon Accounting Manual and draws on federal and industry standards for information security, including Internal Revenue Service guidance and the Center for Internet Security’s critical security controls. “No matter the environment — physical, digital, financial — internal controls have similar attributes,” Messenger said.

DOR described specific personnel and technical safeguards. The agency said all employees undergo a tax compliance check before hire and…