Legislative Audit Committee releases FY2025 statewide single audit; auditors identify material weakness in state controller'9s office

The Legislative Audit Committee voted to release the State of Colorado'9s fiscal year 2025 statewide single audit after hearing auditors summarize the reports and key findings.

Deputy State Auditor Marissa Edwards told the committee the audit team issued an unmodified (clean) opinion on the state'9s financial statements for FY2025 and that the statewide single audit reviewed roughly $65.9 billion in state assets, $56.3 billion in state expenses and $20.8 billion in federal expenditures. "We have issued an unmodified or clean opinion on the financial statements for this fiscal year," Edwards said.

Despite the clean opinion on the financial statements, auditors presented a separate material-weakness finding directed at the Office of the State Controller (OSC). Audit manager Salome Nagasa identified the finding (2025-021) as a material weakness, saying the OSC did not fully comply with statutory financial reporting timeframes, failed to implement prior recommendations in full, and lacked required IT controls for Gravity, the OSC'9s reporting system. "This finding is classified as a material weakness," Nagasa said. She told the committee the OSC missed the statutory August 4 close and adjusted it to August 8; auditors identified 480 late transactions recorded by state entities totaling about $22.5 billion and 21 late transactions recorded by OSC totaling about $1.6 billion.

Auditors also flagged a payroll error in which the OSC'9s central payroll staff recorded the benefits portion of the last biweekly payroll to FY2026 instead of FY2025, requiring additional corrections by multiple state entities. Nagasa said Gravity remains out of full compliance with Colorado Information Security policies, increasing the risk of errors in the state'9s financial statements.

Committee members pressed auditors on enforcement and consequences. Representative Johnson asked whether noncompliance leads to lost funds or state-level penalties; Edwards said the committee'9s statutory role is to report noncompliance and that the state statutory timelines do not carry additional prescribed penalties beyond reporting. She added that prior federal timeline failures have, in some years, created federal-reporting concerns that could affect federal funding if not addressed.

State Controller Bob Jaros responded that his office agreed with the first recommendation and that the OSC has taken steps to improve compliance, including sending letters to controllers and CFOs, delivering trainings and working with agencies on corrective actions. "For the first recommendation, we agree," Jaros said, and described ongoing efforts to communicate results to agency leadership and provide training to controllers.

Auditors recommended that OSC implement a formal corrective-action process to notify and ensure state entities correct accounting errors found during monitoring; update central payroll policies and procedures (including staff training and segregation of duties) for pay periods that span two fiscal years; and develop and communicate Gravity IT policies and procedures to comply with Colorado information-security requirements.

The committee released the audit without opposition. The statewide single audit and the annual comprehensive financial report will be posted electronically on the Office of the State Auditor'9s website, and auditors noted the statewide audit includes 1,105 recommendations across audited entities and a qualified opinion on some federal programs where compliance problems were identified.

The committee also discussed links between audit findings and the budget process; auditors and controller staff said legislators and budget staff rely especially on the general fund analyses in the ACFR for budget decisions, underscoring the importance of timely and accurate reporting.

Next steps: the OSC has acknowledged the material-weakness finding and described steps to address it, while the audit report contains formal recommendations that the OSC and other state entities are expected to implement and report on in follow-up.