If you've ever wondered why state agencies in Oregon seem to be caught with their pants down so often with fraud, waste and abuse, Secretary of State Dennis Richardson may have an answer for you:

They aren't bothering to look for it or limit the risk.

Richardson's office issued an audit Wednesday lambasting state agencies' internal audit functions, saying they had been consistently understaffed, undervalued and neglected by leadership, so much so that agency directors are largely unaware of the activities of their auditors - if they even have one.

That's not always a choice, by the way. Since 2005, state law requires state agencies to have an internal audit function if they meet certain budget or employment thresholds. Thirty agencies meet the criteria, but all but six have only a single auditor and some of the positions are vacant.

Within those 30 agencies, internal audit staff is at its lowest ever level, and has decreased by 40 percent, from 53 a decade ago to only 32 today. If Oregon adopted the same audit staffing model as North Carolina, the number of auditors would need to increase by 70 to 137, it noted.

Internal auditors are supposed to be the frontline investigative staffers within agencies. They're the daily person, independent of management and deeply familiar with agency operations and internal controls, charged with ensuring that business is being conducted efficiently, according to applicable rules and laws, and that the agency, its customers and taxpayers are being protected from possible risks.

In many cases, the audit concludes, that's simply not happening, leaving the agencies at risk of fraud, risk and scandal. Agencies are holding the positions open for budget savings. It cited a variety of agencies where the lack of internal controls had played role in abuse, waste and scandal, including the Oregon Health Authority, the Oregon Department of Energy, the Department of State Lands, and the Oregon Youth Authority.

The audit and an accompanying press release from Richardson were highly critical of the Department of Administrative Services, which is charged with coordinating internal auditing activities among agencies. The audit said it had failed to take a strong leadership and oversight role.

"I'm disappointed that DAS plans to delay implementation of nine of the 16 audit recommendations for over two years," Richardson said. "This shows an unfortunate aversion to accountability."

In addition he said DAS had done little to fulfill its obligation to promote effectiveness and ensure the integrity of internal auditing in state agencies.

The agency didn't necessarily disagree with the audit findings. But a spokeswoman for the agency, Elizabeth Craig, said funding for the internal audit function had been so deeply limited over the years that DAS itself had reduced its own internal audit staff from three to one.

"We're doing what we can with limited resources," she said. "The other thing we tried to point out is that we need support at the agency level for the internal audit functions. I don't know if we can force executive sponsorship. It has to do with the culture of each agency."

Steve March, Multnomah County's auditor and a former state legislator, placed blame on both agencies and the legislature

"As many agencies are wont to do, you tend to say we'd rather put money into services than internal audit. It's a natural tendency," he said. "But do you absolve the legislature of responsibility...If an agency comes in with a budget proposal that doesn't have an auditor in it, they're not fulfilling their responsibility.

The audit made sixteen recommendations that involved beefing up and standardizing the audit functions in state agencies.

Jody Wiser, the founder of the advocacy group Tax Fairness Oregon, summed up the problem from her perspective: "Internal controls are important, but if you deplete budgets at all levels of government for 30 years, did you really expect to get quality outcomes?"

- Ted Sickinger

503-221-8505; @tedsickinger