Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Internal Control topic
No spam. Unsubscribe anytime.
State Board of Internal Control adopts FY27 work plan, shifts to risk-based testing
Summary
The State Board of Internal Control and Bureau of Finance and Management told GOAC they've largely completed agency onboarding and will move in FY27 to validate controls through risk-based testing; metrics cited include 98.6% semiannual attestation response and 14,035 identified risks statewide.
Jim Twiliger, chair of the State Board of Internal Control, and Ally Kerr, director of the internal control team at the Bureau of Finance and Management, presented the board's FY27 work plan and progress to the Government Operations and Audit Committee.
Twiliger said the board has shifted from onboarding agencies to sustainment and validation. "One of the things that we've done in the past is onboarding; now we're moving into phase two where we're going to be performing our risk-based testing," Kerr said, describing plans to test whether documented controls operate effectively.
Kerr told the committee the board has implemented its internal control framework in 28 agencies with one agency in progress. She cited a 98.6 percent response rate to semiannual control attestations and an agency-reported inventory of about 14,035 risks and 3,800 documented controls, with agencies reporting 175 instances in the latest period where a control did not operate as intended. Kerr said those instances reflect the system's ability to surface issues before they become audit findings.
The board adopted an FY27 risk-based work plan at its meeting and will prioritize testing and corrective-action monitoring. The committee acknowledged receipt of the work plan by voice vote and asked staff to keep the legislature informed of implementation progress.
Twiliger and Kerr said the board will continue outreach and training, and that recent legislation (SB 61, 2025 session) strengthened the framework and funded additional internal-control positions in larger agencies to sustain the program.
