Legislative auditors outline backlog of uncorrected findings, cite IT and documentation gaps

April Renfro, legislative auditor with the Legislative Services Office, told the Joint Finance and Appropriation Committee on Jan. 7 that her team is tracking a mix of recent and longstanding uncorrected audit findings and that most outstanding items come from the current reporting period.

"We currently have 30 financial and IT auditor positions," Renfro said, adding that the office also has "one administrative assistant" and several openings. She told members the division performs the annual audit of the state's Annual Comprehensive Financial Report (ACFR) and the state's single-audit work that covers federal awards reporting.

The auditors are required to issue an annual report of uncorrected findings. Renfro said 70% of the uncorrected findings are from the current reporting period — meaning the agency has not yet had the committee's standard follow-up testing — and roughly 30% reflect items agencies have been unable to correct within a reasonable time.

Renfro described three recurring categories of findings: internal-control weaknesses, noncompliance with statutes or policies, and substantive errors in financial or federal reporting. She said pandemic-era federal funding increased single-audit findings in 2023 because agencies that do not normally receive federal awards lacked familiarity with federal compliance requirements.

The audit team flagged several specific examples. A Department of Fish and Game accountability audit found travel expenditures that were not adequately documented under state travel policy; follow-up visits showed partial fixes and, in some cases, reversion to uncorrected status while the department transitioned to a new financial system (LUMA). Renfro said the office is still finalizing its fiscal-year 2023 accountability report.

The Department of Health and Welfare's 2023 accountability report included findings on foster-care placements. Renfro said testing of 19 qualified residential treatment program placements found missing or incomplete documentation: 10% lacked required assessments, 21% had no readily available court order, 84% did not retain court notices identifying placement dates and levels of care, and 42% lacked timely case consultations. She described those as qualitatively significant because they relate to care decisions for youth in state custody.

On information-technology and system-control issues, Renfro said systemic IT weaknesses can be especially serious because they allow a pattern of errors or unauthorized transactions; examples included insufficient segregation of duties and undocumented annual updates to benefit matrices. For one federal program, the auditors found that review and approval of annual updates to the low-income home energy assistance benefits matrix were not documented, increasing the risk of error.

Renfro also told the committee that the LSO audit office completes roughly 28 opinion or IT reports annually and about 21 accountability reviews each year. The ACFR audit is typically due after agencies provide draft financial statements in November so the auditors can issue their opinion by Dec. 31; the single-audit report is normally due March 31. This year, Renfro said, the state controller provided draft statements on Dec. 30, creating a delay that will likely push the ACFR and single-audit completion dates later than statutory deadlines.

"We knew they would be delayed this year... we didn't receive them until December 30," Renfro said, explaining the late delivery limited the auditors' ability to complete the ACFR by Dec. 31 and will likely delay the single-audit filing.

Committee members asked about consequences for agencies that do not correct findings. A committee co-chair said the Legislature may withhold funding or otherwise take action when agencies repeatedly fail to resolve problems. Renfro explained some disagreements about findings are resolved with federal grantors; in rare cases a finding can be rescinded if the grantor sides with the agency, but she said that outcome is uncommon.

The audit office is distributing its uncorrected findings report to the committee the same day. Renfro urged work-group members to review open findings tied to agencies in their portfolios and said the audit office would perform follow-up visits — typically a 90-day check, a first annual and a second annual — to test whether corrective actions worked.

Committee members noted the auditors' workload and praised the audit staff for expedited work amid delays tied to the state's financial reporting schedule. Several members asked Renfro to communicate with federal cognizant agencies about the anticipated delay to minimize grantor concerns.

The auditors' presentation included statutory references to the LSO's authority (Idaho Code, including the provisions Renfro cited) and described follow-up processes required under auditing standards for ACFR and single-audit findings.

The committee did not take formal action during the presentation. Members were directed to the audit materials on the legislative budget SharePoint site and told that the uncorrected findings table includes hyperlinks to full reports for each outstanding finding.

Ending: The audit office will continue its scheduled follow-ups and complete the outstanding reports as staff finish the ACFR and related reconciliations. The committee co-chairs urged members to consult the open-findings report when reviewing agency budgets and to raise unresolved audit items in work-group deliberations.