This audit determined whether selected state agencies and school districts adequately complied with certain IT security standards and best practices. State agencies must follow state IT security standards to protect sensitive information against data loss and theft. Local entities are not required to follow the state's policies. 8 of 15 entities we audited did not substantively comply with IT standards and best practices in at least 2 of 3 subject areas we evaluated. Specifically, 9 of 15 entities did not substantively comply with selected systems operations and configuration controls. 8 of 15 entities did not substantively comply with selected continuity of operations planning controls. Lastly, 7 of 13 entities did not substantively comply with selected data center controls. The findings demonstrate a poor "tone at the top" at many entities--meaning lack of top management oversight and supervision. Other factors contributing to the findings included too much reliance on contracted entities, unfamiliarity with requirements, and shortage of IT security staff.

Overall, we found that changes made to bills after fiscal notes were submitted resulted in most of the inaccuracies we saw. But a few fiscal notes were unreasonable because of agencies' methods. Statute requires the Division of the Budget (Budget) to provide fiscal notes for original bills but outlines only a few requirements for them. Budget works with agencies to create estimates for all original bills, but not amendments. We reviewed 10 fiscal notes from enacted bills to determine fiscal notes' accuracy and 10 fiscal notes from bills that died to determine the reasonableness of agencies' methods and estimates. 7 of 10 fiscal notes for enacted bills differed significantly from their actual fiscal effects, mostly due to bill amendments or other changes made after the fiscal notes were submitted. Most other states update fiscal notes after bill amendments to account for this, but Kansas doesn't. 3 of 10 fiscal notes for bills that died appeared to be unreasonable because they didn't include complete or correct information. Of these, 2 were unreasonable because agencies used questionable data and assumptions, and 1 was unreasonable because Budget left out a potentially large cost to the state. Finally, we didn't see evidence Budget coordinated with agencies on fiscal notes like we would've expected.

Our January 2020 audit of the juvenile justice reforms (Senate Bill 367) had recommendations related to improving and sharing available juvenile offender data across several agencies and strengthening the Department of Correction's grant approval processes. In this follow up audit, we determined the 2 agencies implemented 4 of the 5 recommendations we made in the 2020 audit. Specifically, as of February 2022, the Kansas Department of Corrections implemented all 3 recommendations. The Office of Judicial Administration has implemented 1 and is currently implementing the other recommendation. We also noted the Office of Judicial Administration's centralized case management system project is significantly behind schedule.

In 2016, the Legislature passed a law requiring a performance-based budget system. The system was supposed to be implemented in 3 phases--a program inventory (due January 9, 2017), an integrated budget fiscal process (due January 6, 2018), and a performance-based budget system (due January 14, 2019). We reviewed whether the system was adequately implemented as outlined in state law, and whether state agencies provided complete, accurate, and reliable information. For the first question, we found the Division of the Budget generally met the basic requirements in state law. But the performance-based budget system doesn’t seem to have changed the way the state makes budgeting decisions. That’s partly because statute is very general and allows a lot of discretion. For the second question, we found that most of the 79 state agencies we reviewed submitted the required information to Budget. We evaluated the quality of the program inventories and performance measures that 7 of those agencies provided. 5 of the 7 agencies’ program inventories didn’t include all required information. 1 agency only had output measures (no outcome measures). And 3 agencies’ performance measures had significant accuracy or reliability issues.

Substance abuse and mental health treatment in Kansas is provided by a network of providers and overseen by several state agencies. Individuals can seek treatment for a wide variety of conditions. The 23 providers we interviewed reported using many practices and programs to address their clients’ needs. Almost all of 11 programs and practices most commonly reported by providers had at least some research indicating they were effective. But data limitations kept us from assessing how well they are working in Kansas. Additionally, Kansas substance abuse and mental health providers use similar practices and programs as five other states we reviewed. We were not able to compare Kansas's outcomes to other states because of data limitations.

Senate Bill 367 reforms reduced out-of-home placements and increased community program funding for juvenile offenders in Kansas. Senate Bill 367 aimed to reduce the number of juvenile offenders put in out-of home settings like prisons, jails, and group homes. Out-of-home placements declined by 40% to 60% each year since the reforms were made. The reforms also aimed to create new community programs aimed to reduce recidivism. The Kansas Department of Corrections has spent about $9 million to create or expand community programs for juvenile offenders. Programs were generally available across the state, but more programs may still be needed. Department of Corrections did not have a process to ensure judicial districts used grant funds on appropriate programs. Stakeholders told us several Senate Bill 367 reforms had a negative impact on the juvenile justice system. These include the new probation, detention, and case time limits, as well as the graduated responses to probation violations. Stakeholders were more positive about the new youth assessment tool, but were split as to the effectiveness of other reforms. Kansas created a process to determine if Senate Bill 367 reforms were successful, but the process has not been used. In fact, only 2 of the 11 monitoring requirements we reviewed had been implemented.

The state could generate about $500,000 in one-time revenue by selling surplus property at three state agencies. We estimated that the Adjutant General’s Department could sell property in Saline County for about $250,000, the Kansas Commission on Veteran’s Affairs could sell property in Cowley County for about $150,000, and the Kansas Department of Corrections could sell property in Cowley and Shawnee counties for about $100,000 and $50,000, respectively. The vast majority (80%) of any surplus real property sale revenues go to the Kansas Public Employees Retirement System (KPERS) and the remainder goes to the selling agency. Finally, the Department of Administration still did not have sufficient guidance or processes to help agencies identify and sell surplus property, as required by state law and identified in our 2012 audit.

The three agencies we reviewed fully implemented two of the six recommendations made in our prior audit reports. As part of a 2016 audit of the Department for Children and Families’ (DCF) policies and procedures to ensure the safety of children, we found problems related to background checks and monthly in-person visits and issued two recommendations. We determined the department partially implemented one recommendation and fully implemented the other. As part of a 2015 audit to follow up on safety issues at the Kansas Juvenile Correctional Complex (KJCC), we found continued issues with supervision of juvenile offenders, tool inventory and destruction, and tracking of disciplinary actions and issued three recommendations. We determined KJCC fully implemented one recommendation and partially implemented two recommendations. As part of a 2015 audit to follow-up on issues related to the Kansas Department of Education’s (KSDE) oversight of virtual schools, we found two additional issues related to oversight and issued one recommendation. We determined KSDE partially implemented the recommendation.

Abstract not available.

The Kansas Juvenile Correctional Complex (KJCC), the state’s only juvenile correctional facility, is located in Topeka and administered by the Kansas Department of Corrections. We surveyed current and former KJCC non-management staff to gather their opinions on the management culture at the facility. Of the 219 staff who received a survey, 48 responded (a 22% response rate). These respondents had mixed opinions about KJCC’s management culture. For example, although only 6 respondents agreed that employee morale is high at KJCC, 27 agreed or strongly agreed that they hoped to be working at the facility in a year. Further, although 23 respondents agreed or strongly agreed that they felt safe working at KJCC, 7 respondents reported being attacked or assaulted by other KJCC staff during the past year.

State law calls for an annual audit of the general purpose financial statements and “the financial affairs and transactions of a state agency required to comply with federal government audit requirements…” CliftonLarsonAllen, under contract with Legislative Post Audit, conducted this two-part audit. This first part is the report on the state’s Comprehensive Annual Financial Report (CAFR). The second part, the Independent Auditor’s Report on Compliance for the Major Program and on Internal Control over Compliance Required by the Uniform Guidance, will be issued as a separate report. The auditors expressed an unmodified opinion on the financial statements, meaning that, financial statements present the state’s financial position fairly and in conformity with generally accepted accounting principles in all material respects. However, the auditors did emphasize two matters with regard to the financial statements. First, at the end of fiscal year 2017, the state had a deficit in its general fund of $514.6 million which raises concerns about the state’s ability to meet its future financial obligations. Second, adjustments were made to the beginning net positions and fund balances to account for the merger between the Kansas Bioscience Authority and the Kansas Department of Commerce. The auditors reported two significant deficiencies in the state’s internal control over financial reporting. These included issues related to identification of captial asset errors that occurred in prior years, and an error made when compiling cash balances. Because of this, some previous fund balances were restated.

Local and national media reported that three security incidents took place at the El Dorado Correctional Facility in May and June 2017. The May 9 incident appears to have been a spontaneous protest, the June 24 incident began as a conflict between two gangs and expanded because several doors were not properly secured, and the June 29 incident started in response to a sudden change in the inmates’ shower schedule. Most inmates did not participate in these incidents, and our review of the available evidence confirmed the department’s reports of minimal injuries and property damage. Finally, department officials told us they intentionally allow inmates to maintain control within confined areas of a facility during security incidents as part of their response strategy to reduce the likelihood of injuries and property damage.

The Kansas Department of Corrections (KDOC) operated two minimum-security “honor camps” at El Dorado and Toronto until 2009, when they were closed due to budget constraints. KDOC spent about $17,000 in fiscal year 2017 to maintain the two vacant facilities. KDOC owns the honor camp buildings, but the federal government owns the land on which they are built. The land on which the honor camps are built can only be used for recreational purposes. KDOC’s options for the facilities are limited by the cost to maintain, repair, and remodel the facilities, as well as the federal restrictions. It appears that KDOC has only two feasible options: to demolish the facilities or continue to pay for their minimal upkeep until the federal government requires it to act. KDOC officials estimate it would cost approximately $225,000 to demolish both facilities. KDOC could continue to pay for minimal upkeep of the two facilities which is likely to cost about $17,000 per year. However, it is unclear how long the federal government will allow KDOC to keep the buildings vacant.

The Kansas Department of Corrections (KDOC) plans to rebuild the Lansing correctional facility and is considering both state financing (bonding) and contractor financing (leasing) for the project. We used a Life-Cycle Cost Model to estimate which financing option would be most cost effective. Our analysis found bond financing with contracted maintenance would likely be the most cost-effective option. These two financing options for rebuilding Lansing create some additional risks and benefits for the state, primarily related to contract terms and project costs.

Although substance abuse can result in substantial criminal justice and social service costs, expanding treatment is unlikely to achieve significant savings. We estimated an additional 4,500 to 7,000 individuals are eligible for state-funded treatment and likely to seek it. To provide that treatment, the state would spend between $7 million and $11 million during a three-year period. However, we estimated the state would only reduce spending on other services (i.e. prison, foster care, or state hospitals) by $500,000 to $6 million for those individuals, which would not offset the cost of their treatment. Our results are significantly different from other studies which found greater savings related to providing substance abuse treatment primarily because we focused only on savings to the state and because many of the studies included savings in their estimate that we do not think would be realized.

The Kansas Juvenile Correctional Complex’s (KJCC) primary responsibility is the daily care, custody, management, and treatment of juvenile offenders. Our July 2012 audit of KJCC identified numerous problems that compromised the safety and security of offenders and staff, including a poor security environment and poor personnel practices. KJCC has made progress since our 2012 audit, but some safety and security problems remain. Specifically, KJCC has taken many actions that substantially addressed nine of 12 recommendations from the 2012 audit. It implemented a new process to track investigations into abuse, neglect, and sexual assault of juvenile offenders. Additionally, KJCC now has a process to internally review critical incidents. Officials have also improved personnel practices related to background checks, staff training, and staffing analyses. Further, KJCC has greatly improved its processes to inventory, track, and secure keys and tools. KJCC’s process also ensures searches are generally frequent and documented. KJCC implemented a new process to address prohibited items, although some items did not make it into that process as they should. Finally, medical staff generally were notified when juvenile offenders were found with alcohol or drugs, but we could not verify if other staff were also notified. KJCC’s actions failed to adequately address two of the 12 audit recommendations. Specifically, as was the case in 2012, KJCC staff did not adequately supervise juvenile offenders. In addition, not all KJCC policies have been updated as needed since our 2012 audit. Finally, officials described taking actions to address our 2012 audit recommendation on staff discipline. Officials believe these actions improved their overall disciplinary process. However, we could not fully evaluate whether officials’ actions addressed our audit recommendation on staff discipline. We did however have several concerns regarding officials’ process in this area.

We evaluated six important IT security controls and the comprehensive IT security management process at nine state agencies. We found that most agencies’ IT security controls we reviewed were not strong enough to help ensure that confidential information was adequately protected. Moreover, most agencies had weak controls to help ensure strong and secure staff passwords, and almost all agencies did a poor job of patching software vulnerabilities for both workstations and servers. Most agencies did not adequately train staff on IT security issues, and none of the agencies had fully developed and tested a continuity of operations plan. While most agencies adequately controlled their IT inventory, four agencies were missing or had lost track of computers. On the other hand, we found only a few problems with network access points, which were largely controlled by the Office of Information Technology Services. None of the agencies had a fully developed security management process, but all nine had at least some process components. Finally, security controls were far stronger at agencies where management made IT security a priority.