Audit Release: Oregon’s Framework for Regulating Marijuana Should Be Strengthened to Better Mitigate Diversion Risk and Improve Laboratory Testing


Report Highlights

Gaps in Oregon’s developing marijuana regulatory framework increase the risk of legal marijuana diverting to the black market, especially in the medical marijuana program. To improve marijuana laboratory testing and protect public health, the state should consider requiring testing for heavy metals and microbiological contaminants, enhance test oversight, and ensure labs meet accreditation standards.

Background

Voters approved Measure 91 in 2014, legalizing the production and sale of recreational marijuana in Oregon. However, marijuana remains illegal federally, and federal officials have expressed serious concerns about marijuana from Oregon crossing into other states. The Oregon Liquor Control Commission (OLCC) regulates the recreational marijuana market, while the Oregon Health Authority (OHA) oversees medical marijuana and marijuana lab testing rules. As of November 2018, retail sales had generated $207 million in tax revenue.

Purpose

This audit’s purpose was to determine whether Oregon has adequate controls to deter the diversion of legal marijuana to the black market and to oversee marijuana laboratory testing to ensure test results are accurate.

Key Findings

  1. OLCC is still establishing a regulatory framework for recreational marijuana and has put many controls in place, such as requiring seed-to-sale product tracking and surveillance cameras. However, with no cap on the number of licenses and more applications than expected, staffing and inspections have not kept pace. As a result, only 3% of retailers and 32% of growers have had a compliance inspection.
  2. Structural weaknesses in the medical marijuana program greatly increase the risk of diversion. In contrast to OLCC, OHA lacks the authority to put important controls in place, such as requiring medical growers to have surveillance cameras. The agency has only four permanent staff to inspect roughly 14,000 grow sites and has struggled with decreasing revenues, turnover, and performance management.
  3. All recreational marijuana in Oregon must be tested for pesticides and solvents, but most medical marijuana is not required to be tested. Also, OHA does not require heavy metal and microbiological testing, in contrast to some other states. These contaminants could pose a risk to consumers.
  4. Without a mechanism for verifying test results, Oregon’s marijuana testing program cannot ensure that test results are reliable and products are safe. Limited authority, inadequate staffing, and inefficient processes reduce OHA’s ability to ensure Oregon marijuana labs consistently operate under accreditation standards and industry pressures may affect lab practices and the accuracy of results.

Recommendations

OLCC and OHA agreed with all 23 of our recommendations; for three of them, OHA indicated it would be unable to take action without further statutory authority. The agencies’ responses are included at the end of the report.

Read full report here.

Featured New Audit Release Performance Audit

Audit Release: Oregon Department of Revenue Cybersecurity Controls Assessment


Report Highlights

This audit was conducted to assess critical security controls and the Department of Revenue’s (DOR) information technology (IT) security management program.  We concluded the agency should update its security management program to reflect recent statewide changes to IT security governance structures, as well as correct weaknesses in inventory management, vulnerability management, control of administrative accounts, configuration change management, and audit logging processes.

Background

DOR handles sensitive information, including taxpayer personal information and tax data. The agency, in collaboration with the Enterprise Security Office at the Office of the State Chief Information Officer (OSCIO), is responsible for implementing a security management program to ensure the confidentiality, availability, and integrity of the information with which it is entrusted.

Purpose

The purpose of this audit was to determine whether DOR has implemented an appropriate IT security management program and the basic cyber security controls necessary to ensure cyber defense readiness.

Key Findings

  1. DOR had implemented a security management program, but associated plans and procedures have not been updated to reflect current staffing levels and reorganization of statewide security by the OSCIO.
  2. DOR lacks specific policies and fully automated controls for many elements of the basic security controls identified by the Center for Internet Security. These basic controls should be implemented in every organization to reduce the risk that attackers could compromise systems and data.

Recommendations

We recommend DOR improve its security management program and remedy weaknesses we identified in the basic controls defined by the Center for Internet Security.

DOR agreed with all of our recommendations. The agency’s response can be found at the end of the report.

Read the full report here.

Featured New Audit Release

Audit Release, Oregon Department of Revenue: Enhancing Organizational Culture and Addressing Customer Service Challenges Will Optimize Agency Performance


Report Highlights

Organizational culture is key to shaping how members interact with each other and how they achieve their mission and objectives. However, organizational culture in an organization, such as the Department of Revenue (DOR), can be difficult to assess or change. Both DOR staff and management have identified a desire to shift towards a more collaborative agency culture and share perspectives on how culture can be enhanced to meet employees’ needs. DOR leadership makes decisions regarding agency operations; this report provides information that can help inform some of those decisions. DOR leadership has been engaged with the audit and acknowledged that enhancing the culture is a good opportunity within the agency.

Background

DOR has undergone tremendous change in the last five years. This include several changes in leadership positions, including the Director, and implementation of a critical and expansive information technology system. These significant governance and operational changes affected both internal and external stakeholders. For example, DOR’s customer service rating decreased dramatically, drawing the attention of the Legislature in 2017. We utilized a specialized methodology to assess how enhancing culture could help optimize the agency’s performance. The DOR Director has been supportive of our methodology and appears committed to enhancing the agency’s culture.

Purpose

The purpose of this audit was to determine how changes to DOR’s culture could improve agency performance and to identify factors for the decline in customer service satisfaction from 2013 through 2016 that can be addressed to enhance customer service moving forward.

Key Findings

  1. Opportunities exist to enhance DOR’s operating culture and employee morale. Specifically, DOR management should develop a formal strategy and take action to better incorporate collaborative values within the agency. The strategy should include robust internal communications, an effective accountability framework, a collaborative feedback process, and improved workplace interactions.
  2. The agency’s customer satisfaction declined between 2013 and 2016. A portion of this decrease was due to implementation of a critical and complex IT system known as GenTax. DOR has already identified and addressed a number of customer service deficiencies; as a result, customer service ratings increased in 2017 and 2018. DOR should complete efforts underway to address these challenges.

Recommendations

We made five recommendations to DOR for actions needed to improve its organizational culture and customer satisfaction. DOR agreed with all of our recommendations. The agency’s response can be found at the end of the report.

Read the full report here.

Featured New Audit Release Performance Audit

TEDx Repost: Don’t have 10,000 hours to learn something new? That’s fine — all you need is 20 hours

Wanting to learn something new comes from that best, most curious part of us. But then we have to put in the work. When it’s day three on the keyboard and the cat walking across the keys still sounds better than us, we can get discouraged — and often give up.

Writer Josh Kaufman, author of The First 20 Hours: How to Learn Anything … Fast and The Personal MBA: Master the Art of Business has figured out why so many of us get stopped in our tracks during this early learning period. “Feeling stupid doesn’t feel good, and the beginning of learning anything new is feeling stupid,” he says.

Through trial and error, he has come up with four steps that can help you scramble up the sharp slope of the learning curve in as little as 20 hours. Why 20? As he puts it, “20 hours is doable — that’s about 45 minutes a day for about a month, even skipping a couple of days here and there.”

The mastery of a new skill can be tough and humbling. This post provides practical tips for how to approach the task, or you can watch the video below.

Accountability and Media Featured

GAO WatchBlog Reblog: A lot of government information is freely available

Open government data is government-produced information that anyone can freely use, modify, and share for any purpose. For example, the Treasury Department publishes open data on its new USAspending.gov website, which provides detailed information to help track government spending.

Open data can foster accountability and public trust by giving citizens information about government activities and results. It can also promote private sector innovation and help industries generate revenue, such as by providing demographic, financial, or geographic information. For example, some real estate websites use Census data to provide information on the neighborhoods where homes for sale are located.

The GAO recently reported on ways that the U.S. Treasury may more transparently and effectively share government data through five key practices. While the report addresses federal data, the recommendations and insights may be relevant to a variety of state and local government functions.

You can read the report highlights and recommendations here, and check out the GAO WatchBlog here.

Accountability and Media Auditors at Work Audits in the News Featured

Audit Release: ODE and PPS Must Do More to Monitor Spending and Address Systemic Obstacles to Student Performance, Particularly at Struggling Schools


Report Highlights

At the Oregon Department of Education (ODE) and Portland Public Schools (PPS), monitoring of spending and evaluation of performance is limited and inconsistent, even as student performance continues to lag. This lack of sustained focus limits achievement gains and affects students at high-poverty schools the most. Oregon’s K-12 education funding has fallen into the lower half among states and retirement costs are rising quickly, increasing the importance of ensuring effective education spending.

Background

Since the 1990s, K-12 education funding has shifted substantially to the state, which spends about $4.3 billion a year in addition to local property taxes collected for education. Despite some recent improvement, the state as a whole and PPS specifically still face low graduation rates and large achievement gaps, underscoring the need to improve returns on this investment. However, improving K-12 education requires navigating multiple layers of government, from local to state to federal. PPS’s new leadership has taken important steps toward developing a uniform core curriculum, improving training, and adding student support, but still has substantial work to do. The state is also transitioning to the latest in a series of accountability systems. These challenges increase the risk that a sharp, unified focus on improving student achievement will be further delayed.

Purpose

The purpose of this audit was to examine spending at ODE and PPS, the state’s largest school district, including transparency, controls, and priorities, and determine additional steps these agencies could take to improve returns on the state’s education investments and increase achievement. As a component of the audit, we honored a request from the Oregon Legislature to audit ODE grant management.

Key Findings

  1. ODE does relatively little to support and monitor efficient district spending. The Legislature has not required detailed reviews of school district efficiency outside of narrowly focused initiatives.
  2. PPS has more money to spend per student than many of its state and national peer districts, but the district is spending proportionately less on instruction and more on support services than many of its peers. Potential savings areas we identified include executive administration, substitute teacher use, health benefits, bus service, and legal costs.
  3. PPS needs to develop a more transparent budget, publicly report on the results of its investments in student achievement, and detail how its revenues and spending compare to peer districts. The district also needs to better control increasing employee use of purchasing cards.
  4. ODE and PPS are not adequately evaluating whether grants, contracts, and other dollars, often intended for Oregon’s most vulnerable students, are improving student performance. At PPS, contract issues include poor oversight of alternative education contracts and limited scrutiny of non-competitive contracts. ODE has not adequately evaluated its school improvement efforts under the federal Title I program, focused on some of the most vulnerable children in the state. The lack of sustained focus at PPS and statewide has the most detrimental effect on schools serving high numbers of African-American, Latino, and economically disadvantaged students.
  5. At PPS, inequities affecting these students include relatively high rates of teacher turnover and absences at high-poverty schools, a disconnect between teachers and administrators on managing student conduct, and a teacher hiring and transfer system that contributes to high-poverty schools having less experienced teachers. The district has also not prioritized principal or teacher stability at high-poverty schools, adequately supported principals, or developed a consistent and effective performance evaluation system.
  6. In comparison to students in peer districts, PPS does relatively poorly with African-American, Latino, and economically disadvantaged students. Conversely, the district does relatively well compared to peers with white students and students who are not economically disadvantaged.
  7. ODE’s limited enforcement of district standards, a new K-12 accountability system at risk of delays, a reliance on short-lived improvement initiatives, and a disjointed system of education funding all increase the risk that the state’s student performance will continue to lag. ODE enforcement of standards designed to improve student achievement is limited, and education leaders and the Legislature have not resolved how best to improve districts without infringing on local control.

Recommendations

We made 26 recommendations to help improve return on education investments at ODE and PPS.

Among the key recommendations for ODE:

  • Coordinate with the Governor’s Office, the State Board of Education, the Legislature, and districts to develop a plan to align education investments for the long-term.
  • Work with the State Board and stakeholders to evaluate Division 22 district standards for clarity and enforceability and ensure that ODE has adequate resources to review compliance and enforce standards when districts fall short.
  • For key grants, incorporate best-practice performance management, including setting quantitative and qualitative performance expectations in contracts, establishing baseline measurements, and providing timely and constructive feedback to grantees.

Among the key recommendations for PPS:

  • Investigate and report on potential savings areas in depth, including the level of executive administration, use of substitute teachers and educational assistants due to educator absences, health benefits, bus services, legal services, and building utilization.
  • While working to improve instructional quality, address other obstacles that create inequities at high-poverty schools. Strategies include changes to attendance rules, boundary changes, and practices that could encourage retention of high-quality principals and teachers at high-poverty schools, such as additional pay, enhanced training, and additional classroom support.

We also made a recommendation to the PPS school board. In general, the board should ensure that district administrators prioritize key steps to improve the efficiency and effectiveness of district operations. These steps include developing a strategic plan that focuses on long-term investment and measurement of results, and addressing inequities at high-poverty schools.

ODE and PPS agreed with all of our recommendations, with agency leaders detailing steps the agencies have already taken and providing timelines for completion. The auditees’ responses are at the end of the report.

Read the full report here.

Featured New Audit Release Performance Audit

(ALGA Repost) Opportunities for Improvement: We Need to Talk

“The Yellow Book addresses communication of audit scope and objective at the beginning of the audit, and audit results at the end, but much communication happens, or should, during the audit.

8.23 Determining the form, content, and frequency of the communication with management or those charged with governance is a matter of professional judgment, although written communication is preferred. Auditors may use an engagement letter to communicate key information early in the engagement.

“Written communication is preferred”? Of course an engagement letter and discussion draft are written, and at the federal level, written is probably preferred, but the federal government is astronomically larger than any local audit office, like Jupiter is to Earth. Working under the general assumption that communications must be written, I think, will limit interaction that is critical to the ultimate success of an audit.

Because you all are auditing in a large variety of jurisdictions, I am cautious about recommending universal practices and just urge you to develop your briefing (and listening) procedures around the who, what, when, where, and why appropriate to your government.”

Gary Blackmer, former director of the Oregon Audits Division, discusses how auditors can communicate most effectively with agency heads and staff in his quarterly ALGA post, with practical suggestions for making introductions, engaging the agency in the audit process, finding context for problems, and making sure that your audit is on point. Read more here.

Accountability and Media Featured