Editorial: What is good enough for Oregon government?

We were frustrated this year to see another report from the state showing state agencies with a “No” in the column showing they were not doing a required internal check on how they operate.

So we wrote about it. The editorial ran on Tuesday.

But thanks to an alert reader, Mark Labhart, who happens to be a commissioner of the Oregon Department of Fish and Wildlife; Curt Melcher, the director of ODFW; and Kari Guy, the executive auditor of the department, we discovered something else.

The 2022 report by the Department of Administrative Services is right and good information in a lot of ways. It also fails to line up with the requirements under state law. It suggests ODFW has done something wrong when it has not. There may be other agencies that the report does the same thing to.

The report tracks if agencies had completed required internal audits. “This report summarizes state government internal audit functions over the last fiscal year, July 2021 to June 2022,...” Berri Leslie, the state’s chief operating officer, writes in the introduction. Basically, agencies that process a lot of money are required to do a yearly, risk-based internal audit as a kind of double check on how they do things. ODOT did one on how it evaluates pavement.

The report has a column where it tracks if agencies had done a risk-based internal audit in the past fiscal year. Several agencies have a “No” in that column, including ODFW.

The state requirement for agencies is actually different. The state requirement is that agencies have to do such an audit every calendar year, not fiscal year. And by statute, the DAS report filed every year by Dec. 31 is supposed to look back at the calendar year.

The problem with the report looking at fiscal year is: That is not the requirement under the statute. It also can put a “No” in the risk-based audit category when an agency has done a risk-based audit during the time period required by law.

For instance, ODFW completed a risk-based audit in 2021. It completed a risk-based audit in 2022. But if you look at in fiscal years, ODFW did not complete a risk-based audit in the past fiscal year.

“Yes, we are fully compliant with the requirement to conduct risk-based audits,” Melcher, the ODFW director, told us in an email. “I believe the report from DAS was inaccurate.”

We asked DAS about this on Tuesday. It told us Wednesday it planned to issue an addendum to the report to comply with the statute by April. Leslie, the state’s chief operating officer, made that decision Wednesday morning after we raised the issue.

It’s important to note, though, that DAS was right and wrong at the same time. It made the decision to have the report look back at the past fiscal year to be able to provide more timely information to the Legislature. It would be hard to DAS to finish up a report covering the end of a calendar year by the end of that same calendar year. It plans to propose a change to the statute.

So in the end, DAS has been producing a good report with good intentions that was at odds with state law. Not such a bad thing. But we know it caused concern at ODFW and perhaps other agencies.

Of course, the real problem for Oregonians would not be a botched report time period. It would be the agencies who aren’t doing these reports. It would mean agencies may not be finding problems that they are supposed to be looking for.

We spotted one agency that did not do audits twice in a row according to the latest reports. The Oregon Department of Education has a “N” in 2021 and a “No” in 2022.

Will legislators and Gov. Kotek follow up? Or is producing a report good enough for Oregon government?