ALASKA STATE LEGISLATURE  LEGISLATIVE BUDGET AND AUDIT COMMITTEE  Anchorage, Alaska November 9, 2021 2:04 p.m. MEMBERS PRESENT Senator Natasha von Imhof, Chair Senator Peter Micciche Senator Lyman Hoffman Senator Click Bishop (alternate) Representative Chris Tuck, Vice Chair Representative Ivy Spohnholz Representative Andy Josephson Representative Neal Foster (via teleconference) Representative James Kaufman Representative Dan Ortiz (alternate, via teleconference) MEMBERS ABSENT  Senator Lora Reinbold Senator Bert Stedman OTHER LEGISLATORS PRESENT Senator Mia Costello COMMITTEE CALENDAR  APPROVAL OF MINUTES EXECUTIVE SESSION FINAL AND PRELIMINARY AUDIT RELEASES OTHER COMMITTEE BUSINESS PREVIOUS COMMITTEE ACTION  No previous action to record WITNESS REGISTER KRIS CURTIS, Legislative Auditor Division of Legislative Audit Juneau, Alaska POSITION STATEMENT: Responded to questions and offered an update regarding audit oversight. ERIN SHINE, Staff Senator Click Bishop Alaska State Legislature Juneau, Alaska POSITION STATEMENT: Discussed an audit of TVEP. ACTION NARRATIVE 2:04:24 PM CHAIR NATASHA VON IMHOF called the Legislative Budget and Audit Committee meeting to order at [2:04] p.m. Representatives Tuck, Josephson, Spohnholz, Kaufman, and Foster (via teleconference) and Senators Micciche, Hoffman, Bishop (alternate), and von Imhof were present at the call to order. Also present was Senator Costello. ^APPROVAL OF MINUTES APPROVAL OF MINUTES    2:04:45 PM CHAIR VON IMHOF announced that the first order of business would be the approval of minutes. 2:04:53 PM REPRESENTATIVE TUCK moved that the Legislative Budget and Audit Committee approve the minutes of the August 27, 2021, meeting, as presented. There being no objection, the minutes from August 27, 2021, were approved. ^EXECUTIVE SESSION EXECUTIVE SESSION    2:05:12 PM CHAIR VON IMHOF announced that the next order of business would be an executive session to consider the final audit report for the Board of Chiropractic Examiners and preliminary audit reports for the Regulatory Commission of Alaska (RCA), the Alcoholic Beverage Control Board, and Council on Domestic Violence and Sexual Assault. Progress on fiscal year 2021 (FY 21) annual comprehensive financial report audit and the FY 21 statewide audit. 2:05:46 PM REPRESENTATIVE TUCK moved that the Legislative Budget and Audit Committee go into executive session under Uniform Rule 22(e)(3), for the discussion of matters that may, by law, be required to be confidential. He asked that the following persons remain in the room or online: the legislative auditor and necessary staff for the auditor; any legislators not on the committee; and staff for legislators who are members of the committee. There being no objection, it was so ordered. 2:06:23 PM The committee took an at-ease from 2:06 p.m. to 3:48 p.m. for the purpose of executive session. 3:48:21 PM CHAIR VON IMHOF called the Legislative Budget and Audit Committee back to order at [3:48] p.m. Present at the call back to order were Representatives Tuck, Josephson, Spohnholz, Kaufman, and Ortiz (alternate, via teleconference) and Senators Micciche, Hoffman, Bishop (alternate) and von Imhof. Also present was Senator Costello. ^FINAL AND PRELIMINARY AUDIT RELEASES FINAL AND PRELIMINARY AUDIT RELEASES    3:48:50 PM CHAIR VON IMHOF announced that the next order of business would be final and preliminary audit releases. She said the committee would consider the following four motions: One for the final release of an audit; one for the preliminary release of three audits discussed; one for a personnel wage adjustment; and one for a personal 40-hour work week. 3:49:14 PM REPRESENTATIVE TUCK moved that the Legislative Budget and Audit Committee release the final audit report of the Board of Chiropractic Examiners. There being no objection, it was so ordered. 3:49:33 PM REPRESENTATIVE TUCK moved that the Legislative Budget and Audit Committee move the following preliminary audits to the agencies for response: the Regulatory Commission of Alaska; the Alcoholic Beverage Control Board; the Council of Domestic Violence and Sexual Assault. There being no objection, it was so ordered. 3:49:57 PM REPRESENTATIVE TUCK moved that the pay range of the legislative auditor be set at a Range 30, Step Q, effective November 15, 2021, with no change to the merit anniversary date, as per AS 39.27.011(h), with the understanding that the legislative auditor wage adjustment and other planned wage adjustments for audit staff will be absorbed into the existing budget and that no increases to the FY 22 or FY 23 budgets are needed to provide the adjustments. REPRESENTATIVE JOSEPHSON asked how the committee could know that extra appropriation is not needed for FY 23. 3:51:00 PM KRIS CURTIS, Legislative Auditor, Division of Legislative Audit, responded that although not a certainty, it is difficult to hire in the upper ranges, and "you can only absorb so many lower ranges." She confirmed she would have available cushion in her budget to absorb the adjustments. 3:51:28 PM CHAIR VON IMHOF announced that there being no objection, the motion was approved. 3:51:33 PM REPRESENTATIVE TUCK moved that the Legislative Budget and Audit Committee authorize a 40-hour work week for the Division of Legislative Audit Data Processing Supervisor II, with [commensurate] increases to compensation, effective November 15, 2021. There being no objection, it was so ordered. ^OTHER COMMITTEE BUSINESS OTHER COMMITTEE BUSINESS    3:51:58 PM CHAIR VON IMHOF announced that the next order of business would be Other Committee Business. She indicated the first topic would be regarding two pending audit requests. 3:52:39 PM SENATOR BISHOP introduced his chief of staff, who would give an overview of the first audit request. 3:52:54 PM ERIN SHINE, Staff, Senator Click Bishop, Alaska State Legislature, stated that last session, a letter of intent was attached to HB 100, which she described as legislation that reauthorized the Technical Vocational Education Program (TVEP). The letter of intent requested an audit of TVEP to be completed by the legislative auditor, and that audit is what is currently before the committee. She said TVEP continues to be authorized each sunset period; however, during the legislative process, there have been questions raised that go unanswered. She explained that the concerns are never about the merits of the program but about the participants and distribution list of the funds. She stated that the goal of the audit is to provide the legislature with data to use during the next legislative process. 3:53:51 PM REPRESENTATIVE KAUFMAN spoke about transparency as an issue considered when determining the reauthorization of TVEP, and he asked how easy it is for a customer to determine the value of TVEP. He queried, "Would this look ... at any of that, as far as the ... user interface with the system?" MS. SHINE indicated she could not answer regarding the user interface, but she said the audit is attempting to get broad data regarding funds being distributed and participants on the list. She said the list is in statute; the distribution is not a competitive process. She allowed that what she knows about TVEP may not be up to date. She explained that this issue arose during the last days of session. She estimated that TVEP had not been audited for 20 years. She said Senator Bishop's office staff worked on the TVEP issue its last two sunsets, as well as worked with Ms. Curtis and her staff to consider which questions to ask in order to provide the legislature with concrete data for the next reauthorization process. 3:55:50 PM CHAIR VON IMHOF relayed that one of the things being looked at is how programs are spending money. In terms of whether a program is or is not good, she said it is the marketing effort that attracts people to a program. Regarding considerations about TVEP, she said one factor was how many people got jobs after completing TVEP and how long those people kept their jobs. 3:56:42 PM SENATOR MICCICHE said he was a spectator during the last round of reauthorization consideration for TVEP but has been involved in other programs as they have been assessed by the legislature, and he likened discussions on these topics as playing a game of [telephone] where what is being said changes as the discussion circles. He expressed appreciation for the information that the audit would bring. He said better decisions can be made when defensible data is made available. 3:57:40 PM REPRESENTATIVE SPOHNHOLZ expressed support for the audit. She asked that there be consideration during the audit that when looking at jobs for post-high school programs "we're talking about jobs that are in fields for which they've been trained" not "a job at McDonalds, which is not, in fact, relevant to workforce training." She said TVEP programs vary; some are created for high school level, while others focus on "a career right at age 18." 3:58:41 PM REPRESENTATIVE TUCK moved that the Legislative Budget and Audit Committee approve the TVEP audit request to look at the following objectives: identifying reports on the use of the TVEP funding for the period of FY 19 through FY 22 to include, by institution, the types of training provided, the age of students, the number of students, as well as any non-training spending such as capital improvements; evaluate the way TVEP is structured to effectively meet the technical and vocational training needs by the region and/or by industry; evaluate the program's performance measures and determine whether TVEP's training institutions are consistently reporting reliable performance information and whether alternative measures would be more useful in measuring the degree training institutions are successfully meeting the intent of the programs; evaluate the efficiency of the accountability and oversight of the TVEP training institutions identified in AS 23.15.835, and determine how those procedures differ from training grantees; determine whether TVEP funds are awarded in an equitable manner and, if warranted, recommend an alternative funding mechanism for many of the intents of TVEP; and follow up on any related concerns the legislative auditor identifies during the audit. 4:00:33 PM CHAIR VON IMHOF announced that there being no objection, the motion passed. 4:01:01 PM REPRESENTATIVE SPOHNHOLZ addressed the next audit request. She reported that the last time the Legislative Budget and Audit Committee did an information technology (IT) audit was 2008, and since then there are more services on line and increased security attacks on the state's IT system, including breaches of the IT systems of the Department of Health and Social Services and the Alaska Court System. She relayed there have been two attacks on the Division of Elections, one by Russian hackers in 2016, and while both the division and the lieutenant governor have said neither of the attacks undermined the security of Alaska's elections, she is deeply concerned that people have had their personal information stolen: 113,00 Alaskans had their personal information stolen from the Division of Elections, and up to 700,000 Alaskans had their personal information stolen from the Department of Health and Social Services. These attacks have broad effects, including to contractors with the State of Alaska and in the realm of public safety. REPRESENTATIVE SPOHNHOLZ said she has worked with Kris Curtis in the Division of Legislative Audit to request an IT review. She said an IT security audit would be the most rigorous and most expensive, while an IT review would be a more modest approach allowing a broader range of consultants to respond to the request for proposals (RFP). She said Ms. Curtis would offer more details, but she noted that the review could look for systems most at risk, prioritize them, and then identify the resource policies and procedures and infrastructure necessary to prevent [future attacks]. She indicated that those involved should work with the state's Office of Information Technology (OIT), within the Department of Administration. She remarked that the department had been "somewhat reluctant to engage in the process." She stated her belief that "this will be a cost- saving measure for the state moving forward." She explained that to-date, the State of Alaska has spent over $1 million in response to emergency crisis situations [related to security breaches]. She noted that there is a sum of $11 million related to the American Infrastructure and Jobs Act for which the State of Alaska would be eligible for the purpose of state information technology security infrastructure. She offered to answer questions. 4:04:55 PM CHAIR VON IMHOF described OIT as "a behemoth," and she asked whether the focus would be on just security or whether there would be any other focus, such as how the ARIES and Medicaid systems are working. 4:05:25 PM REPRESENTATIVE SPOHNHOLZ answered that "that's a very expensive project," and she emphasized the need for urgent response rather than waiting several years for a comprehensive review of the state's overall IT system. She indicated the focus would be on security, and she said the state does not want to be in a situation in which it would have to pay ransom. She noted that people have been "providing services and not getting paid for them," which is problematic. 4:07:11 PM SENATOR MICCICHE asked whether Representative Spohnholz would consider a motion that would support the audit but also support the Legislative Budget and Audit Committee to allow the Division of Legislative Audit "to come back with an analysis of what a further audit would look like on functionality." REPRESENTATIVE SPOHNHOLZ responded, "Absolutely." She expressed the need for Alaska's system to be modernized, but reemphasized her focus on security at present. 4:08:04 PM CHAIR VON IMHOF remarked that the committee is asking the Division of Legislative Audit to do a lot, and she asked for confirmation that outside expertise would be sought. 4:08:22 PM KRIS CURTIS, Legislative Auditor, Division of Legislative Audit, answered yes, but said work would need to be done to figure out what has already been done "in order to feel good about tracking the procurement." She said she assumes OIT has ranked its system in terms of vulnerability and risk, and if that has already been done, then the Division of Legislative Audit can figure out what to request; if not, then the division may have to conduct a mini IT review and then go from there. She said anything over $30,000 would need to be approved by the Legislative Budget and Audit Committee. CHAIR VON IMHOF indicated that the committee may not have the capability to address the division coming back with a bigger proposal. MS. CURTIS talked about the many layers of an audit and echoed Representative Spohnholz' remarks about the key issue being security. She talked about asking questions as related to a few high-risk systems, and pointed out that, in theory, the vulnerabilities with those will be the same as would be seen "across the board." She said she anticipates figuring out what lessons can be learned and from there deciding what needs to be done next. 4:10:42 PM REPRESENTATIVE KAUFMAN questioned how to determine the scope and ensure the right steps are being followed so that the end result is "a product that addresses the problem." CHAIR VON IMHOF asked Ms. Curtis and Representative Spohnholz whether they have a plan "to find out what the scope is." 4:11:44 PM MS. CURTIS said there is a limited ability to demand information from OIT without an approved [audit] request. She said she assumes OIT will be cooperative. She said she may need to seek expert advice. She asked whether the committee would be meeting again before next session. CHAIR VON IMHOF said the Legislative Budget and Audit Committee would meet again mid-December. MS. CURTIS indicated she would not have time by then but perhaps the committee could meet once more before start of the next session [which begins January 18, 2022]. CHAIR VON IMHOF indicated there is a motion to get the process going wherein Ms. Curtis would be able to approach OIT "with something tangible" in her hands. 4:12:58 PM REPRESENTATIVE TUCK reviewed the points that he would cover in his upcoming motion related to the audit. REPRESENTATIVE SPOHNHOLZ pointed out that due to the sensitive nature of the topic, the report that results from the audit would not be made public; IT issues would be discussed during executive session. 4:15:12 PM REPRESENTATIVE TUCK moved that the Legislative Budget and Audit Committee approve the information technology systems audit request as presented by Representative Spohnholz, to facilitate a review of the State of Alaska's information technology systems, particularly the public-facing systems, those that contain Alaskans' personal information and those necessary to pay grantees or contractors of the State of Alaska. He stated the objective would be to identify all state IT systems and rank the systems in terms of significance and risk. A comprehensive security review of the most significant systems most at risk for infiltration should be conducted. The review should identify what is needed to prevent future security breaches including resources, policies and procedures, staff training, expertise, or infrastructure. Additionally, the review should analyze the State of Alaska's IT security training policies and procedures aimed at reducing the effectiveness of phishing schemes whereby an employee may inadvertently allow incursion of the security system. A further objective would be to get recommendations from the Division of Legislative Audit or suggestions for future follow-up audits. He stated that due to its sensitive nature, neither the audit nor discussions about the audit would be made available to the public. CHAIR VON IMHOF announced that there being no objection, the motion was approved. 4:17:11 PM The committee took an at-ease from 4:17 p.m. to 4:26 p.m. 4:26:27 PM CHAIR VON IMHOF announced the committee would address the final item under other committee business regarding an audit oversight framework for following up on audit findings, as presented by Representative Kaufman during the Legislative Budget and Audit Committee meeting on August 27, 2021. She advised that under the framework, the auditor identified the top ten audit issues from the prior fiscal year and asked that the applicable executive branch agencies provide the status of corrective action. Chair Von Imhof said agencies formally communicate the status in writing to the legislative auditor who then summarizes the results and presents them to the Legislative Budget and Audit Committee, at which point, the findings would be forwarded to the appropriate Finance subcommittees for consideration during the budget process. She stated that this new oversight framework encourages resolution and helps identify ways the legislature can partner with agencies to address audit findings. CHAIR VON IMHOF noted that the public and the committee members were asked to review the top ten audit findings noted during the August 27 meeting and make recommendations. She stated the goal for this meeting is to consider the top ten audit findings and authorize the legislative auditor to move forward with the new audit oversight framework. Chair Von Imhof invited Kris Curtis to summarize her original presentation to the committee, including the top ten findings, after which she said she would invite questions and discussion from the committee. 4:27:57 PM MS. CURTIS remarked that Chair Von Imhof had covered in her opening remarks what she had planned to say. She said she would like to give the Legislative Budget and Audit Committee the opportunity to add to or subtract from the list of top ten findings. CHAIR VON IMHOF opined that the list was a good one, because it comprised big issues that could also address "smaller things." MS. CURTIS relayed that she had drafted the letters, and in doing so, she noted that she had to approach the financial statement assuming qualifications differently than she approached the letters to the rest of the departments. She said there were two reasons she qualified the opinion on the financial statements. She continued: First has to do with revenues eligible for transfer to the constitutional budget reserve fund. As a result of FERC [Federal Energy Regulatory Commission] decisions, these monies were not transferred ... in FY 18 and FY 19 to the CBR [constitutional budget reserve], and fund balances that should have remained in the CBR were moved to the general fund. ... Second is related to DNR Department of Natural Resources not transferring to the permanent fund all the dedicated ... mineral lease revenues that are due to the permanent fund, and that's for just FY 18 [and] FY 19. MS. CURTIS said the division has gone "back and forth" with the departments on this issue, and the Legislative Budget and Audit Committee has discussed what next steps to take. She indicated that [the Division of Legislative Audit and the departments] are at an impasse because of a difference of opinion in interpreting the Constitution of the State of Alaska. She said her letters served to ask the commissioners of the Department of Natural Resources (DNR) and the Department of Revenue (DOR) whether they are willing to make an adjustment to correct these misstatements. Further, she asked whether the departments had any suggestions for resolving these issues absent direction from the Alaska Court System. Finally, she asked the commissioners whether they are willing to work with the legislature to seek a court ruling to resolve the audit findings to facilitate corrective action. She expressed her plan to let the committee know what response she receives from the departments. 4:31:36 PM REPRESENTATIVE JOSEPHSON pointed to the second bullet point on the list of ten issues [included in the committee packet], regarding DNR's failure to transfer all funds from dedicated lease revenues. He remarked that Ms. Curtis is asking the department whether it agrees it did that and how it will fix the issue; however, he pointed out that that revenue could have gone to the general fund (GF) and been spent. MS. CURTIS responded that regardless of whether the money has been spent, the GF owes the permanent fund approximately $200 million, which is a liability and is the adjustment sought by the Division of Legislative Audit. REPRESENTATIVE JOSEPHSON asked how the department would do that. MS. CURTIS answered that the department would book the liability. She said in terms of a financial statement, the department would state that the GF has a liability, and the permanent fund was "recorder receivable." CHAIR VON IMHOF reviewed the process of the letter being sent, and if the department were to disagree with the assessment in the letter, then a court process would begin. She highlighted that the Legislative Budget and Audit Committee may be asked to take steps to engage in that process, and that she had invited Ms. Curtis to speak today to make the committee aware of that potential. 4:33:42 PM MS. CURTIS noted that this issue originated with the prior administration; therefore, it is possible that the current administration, faced with the issue, may be on board with getting a court interpretation - a "clean opinion." She explained that a court opinion that the funds either belong or do not belong in the permanent fund is the evidence she needs to resolve the issue. She emphasized the importance of moving as a team toward resolution. REPRESENTATIVE JOSEPHSON said he agrees but pointed out that this could be a three- to four-year process. MS. CURTIS responded that she does not know anything about the process but if it takes three or four years to resolve, she expressed, she wishes the process had been started three or four years ago. She added, "It's already been three years since I initially qualified the opinion." 4:35:12 PM REPRESENTATIVE KAUFMAN shared that his awareness of this issue began even before he became politically active, and he emphasized the importance of working through it transparently. He stated that the problem could be in the execution or in the requirement. He said, "I think as we go through this, it's a quality management process, and it's sort of like the chips fall where they may, and we just approach it on that basis." 4:36:30 PM SENATOR BISHOP remarked that the former chair [of the Legislative Budget and Audit Committee] had suggested this plan of action three years ago. 4:36:37 PM SENATOR MICCICHE observed that he and Representative Kaufman come from a background where audit findings were required by law to be resolved immediately, and he expressed he finds it disconcerting that some of the same agencies that required immediate compliance "don't seem to find it as important." He said he supports the recommended process and hopes it will be well-received by the administration. 4:37:45 PM CHAIR VON IMHOF invited Ms. Curtis to speak to "the second type of letter" that had been written to address numbers 3-10 on the list. 4:37:53 PM MS. CURTIS responded that the letter is "pretty generic" and asks about corrective action and the timing of such action. In response to questions from Chair Von Imhof, she said she had planned to give the departments three weeks to respond. She said she had not planned to report back to the Legislative Budget and Audit Committee at its upcoming meeting in mid- December but rather at the following meeting currently scheduled for January 17, 2022. In further response, she expressed amenability to a January 1, 2022, deadline. 4:39:02 PM REPRESENTATIVE TUCK moved that the Legislative Budget and Audit Committee authorize the legislative auditor to carry out the formal audit oversight framework as described at the August 7, 2021, meeting. There being no objection, the motion passed. 4:39:27 PM REPRESENTATIVE KAUFMAN thanked the committee for considering this issue and Ms. Curtis for her work. CHAIR VON IMHOF thanked Representative Kaufman for his involvement and for encouraging the committee to consider the issue. She expressed thanks in general to everyone involved with the issues addressed during the day's meeting. 4:40:28 PM ADJOURNMENT  There being no further business before the committee, the Legislative Budget and Audit Committee meeting was adjourned at [4:40] p.m.