Secretary of State auditors outline FY 2026 plan, propose data-driven risk model to guide work

Deputy Secretary of State Michael Kaplan and Steve Bergman, director of the Audits Division at the Oregon Secretary of State, briefed the Joint Committee on Legislative Audits Feb. 24 on the division's mission, staffing and an outline of its fiscal year 2026 audit plan. They said the division will develop a data-driven, nonpartisan risk model to help prioritize audits for fiscal year 2027.

"Secretary Reed has 3 fundamental pillars, for his administration ... They are integrity, accountability, and competence," Kaplan told the committee, saying the office seeks to make audits "thorough, insightful, and actionable by the legislature." Bergman said the division has two primary objectives: "to protect the public interest" and "to improve Oregon government," and he described a portfolio that includes financial, compliance, performance and IT audits.

Bergman told the committee the Audits Division's budget is just under $29,000,000 and the division has 72 full-time equivalent positions. He said the staff mix includes 33 financial auditors, 28 performance auditors and 6 IT auditors and that the division reviews the State of Oregon's financial statements (reported as approximately $60,000,000,000) and conducts federal single-audit work tied to roughly $20,000,000,000 in federal awards. He said the division's work helps preserve a strong bond rating and overall fiscal stewardship.

For fiscal year 2026, Bergman highlighted planned performance and IT audits that include reviews of adult protective services at the Department of Human Services, a cloud-security strategy assessment, Medicaid program data analytics to identify fraud and cost-saving opportunities, and a Workday payroll system review. He also told the committee the division is carrying over nine projects from fiscal year 2025 related to governance, public safety, behavioral health and IT security and that the new risk model did not itself inform the FY 2026 plan but will inform the FY 2027 plan.

Committee members asked about timing, scope and how the new risk model would be built. Senator Taylor pressed whether the office would refine broadly scoped audit targets and how it would identify leading indicators of risk; Bergman said the inherited plan was "fairly broadly scoped" and that the division will refine targets and solicit input from legislators and agency staff. Bergman described possible numeric indicators of risk such as routine procurement delays or significant leadership turnover, noting such signals are not proof of problems but may guide audit selection.

Kaplan and Bergman said they aim for transparency and to engage the committee while building a nonpartisan, data-driven model. The Audits Division also described regular interaction with agency internal auditors; Bergman said internal auditors are required by statute to provide the Secretary of State with risk assessments and copies of their audit reports, which the division uses to inform monitoring and risk assessment.

Committee members asked about follow-up and whether agencies implement audit recommendations. Bergman said the office's ability to compel change is limited, but that better, targeted audits can provide the legislature and executives with information that increases the likelihood of corrective action.

Committee staff noted the audit plan is posted on OLIS with a short paragraph describing each proposed audit; the division said it will provide more detailed scopes as work moves from the plan into scoping and fieldwork.