Cover Oregon collapse: The mystery of the missing audit

PORTLAND, Ore. - Audits are rarely interesting.

Audits that don't even exist, much less so.

But a missing audit related to Cover Oregon raises the same critical questions it was originally supposed to answer.

The mystery is as complicated as it is important.

Last February, the power players behind Cover Oregon held an emotional meeting.

The job of building the complicated website was spinning out of control, and infighting was rampant.

The issues discussed were both deep and wide-ranging: Everything from transparency to quality assessment to a lack of trust among coworkers was on the agenda.

In attendance were Oregon Health Authority CIO Carolyn Lawson; Lawson's deputy Steven Powell; interim state CIO Julie Pearson; Pearson's deputy Sean McS Cover Oregon director Rocky King; principal legislative analyst Bob Cummings; Cover Oregon CIO Aaron Karjala; Department of Administration Services CIO Ying Kwong; and a representative from quality-assurance contractor Maximus.

The meeting was so intense that once source said Lawson - the woman in charge of building the website - cried through most of it.

When the meeting was over, the group created a report of everything that had been hashed out - 19 issues in all.

Tucked away on page four of that list is a brief item labeled "Oracle Contract Issues." It touches on contracts and accounting the state used with Oracle - the vendor hired to provide much of the website's software and technical support - that were "inconsistent with generally acceptably industry best practice procedures."

Here's where things get interesting.

The report goes on to say the issue was resolved, citing an audit by the Secretary of State's office that "found everything in order."

But the KATU On Your Side Investigators have learned that that audit - the only piece of evidence used to dismiss major accountability problems surrounding a contract that eventually grew to $119 million - doesn't exist.

Flexibility vs. accountability

That audit was particularly important because the state's contract with Oracle lacked the safeguards government's usually put in place to ensure transparency.

Maximus, the quality-assessment contractor the state had hired to provide independent oversight of the project, found 21 Oracle purchase orders that didn't provide adequate Statements of Work (SOW), which are the documents that explain exactly what is being provided in return for money that's being spent.

The total value of those open-ended purchase orders was $119,556,232, Maximus reported on page 62 of its quarterly report. That meant Oracle was authorized to perform almost $120 million of work, with nobody knowing for sure where that $120 million was going.

"Work cannot be readily mapped to the project work plan or schedule," Maximus reported. "These POs include work beyond the scope of the HIX-IT project."

The contract had been designed with expediency in mind. From its birth, Cover Oregon was a high-risk project because of what was considered an extremely aggressive timeline.

But not everybody liked the way Lawson was using this unusual freedom.

Dr. Ying Kwong, a Department of Administrative Services technology analyst, had noticed the SOW problem months before.

He argued that transparency was at least as important as expediency.

"I would think the need for management flexibility must always be balanced by the need for fiscal accountability, transparent project management, and reviewable work and progress," Kwong wrote in an email to Dr. Bob Cummings of the Legislative Fiscal Office.

A history of budget problems

The audit matters because every dollar is critical to Cover Oregon right now.

On Wednesday, Cover Oregon interim director Dr. Bruce Goldberg said at a finance committee meeting that budgetary problems have grown dire. The lack of a website means fewer people have signed up, depriving the exchange of money it was counting on to become self-sufficient.

"We're tracking to a low enrollment scenario for the future," he said, adding that the budget for 2015 has already been slashed from $60 million to $50 million.

The problems are nothing new; the website has been in financial trouble for at least a year.

Lawson was originally scheduled to deliver a ready-to-go website to Cover Oregon in June 2013. Instead, she was forced to hand over the site three months early because $16 million had been misallocated, compounding the problems of a website that was already in deep trouble.

And that's not the only IT project formerly under Lawson's care that has experienced severe budget problems.

She also was put in charge of the ongoing modernization of the Department of Human Services' IT systems.

When she took over, that project - which was meant to tie in with Cover Oregon and other state entitlements in a one-stop-shopping online portal - had a budget of $14.5 million and an estimated completion date of June 2011.

Today, the budget has ballooned to $56.1 million - and it's already gone well beyond that budget with actual spending of $60.8 million. The project is now scheduled to be finished in June 2017 - six years late.

That project has also contracted Oracle.

Lawson, who has close long-term ties to Oracle, was investigated by the state of California before she came to Oregon for funneling money to companies with which she was friendly.

In 2008, she was hired as CIO for the California Public Utilities Commission. Within a few months, she was investigated by the state for improperly awarding about a half-million dollars to a company owned by Steven Powell, a former supervisor whom she later brought with her when she moved to Oregon.

The investigation found that she had, in fact, awarded the contracts in violation of state regulations.

'No audit that would substantiate the statement'

Back to that mystery audit of Lawson's dealings with Oregon on the Cover Oregon project.

The KATU Investigators contacted the Secretary of State's office to ask for a copy of the audit.

Three different people responded, none of whom had a record of it, and finally it was suggested the Department of Administrative Service might know more.

DAS didn't know of such an audit either, and referred KATU to the Legislative Fiscal Office.

The LFO didn't know anything about it, referring KATU back to the Secretary of State's office.

"I checked with our managers and there is no audit that would substantiate the statement that 'a SOS audit found everything in order,'" Secretary of State auditor Gary Blackmer wrote to KATU News. "We have not conducted any audits of procurement or accounting practices related to the DHS/OHA Oracle contract."

A relaxation of accountability was built into the Oracle contract from the start. Lawson successfully argued that she needed to bypass normal channels to meet the website's aggressive deadline - and she fiercely defended her right to do so.

In a Cover Oregon board meeting on June 14, 2012, Lawson showed the board a staffing budget of $61 million - substantially more than the $48 million in grant money the state had been given.

Lawson told the board a "larger bucket" was needed to ensure staffing through Oracle and another company called Covendis. The extra room, she said, would allow her team to quickly hire new staff with little fuss.

"There's been a little bit of consternation because when you look at the numbers, it looks like - the contract amount - that we're overspending," Lawson told the board. "The contract amount is not an amount we're obligated to pay against - unless we use those services.

"Instead of saying oh now we need a different resource from Oracle and then going through the contracting process again, we know we have that headroom, we can send the request, they can get a resource in."

Part of the reason that February 2013 meeting was held was that Lawson was upset with what Maximus had been reporting - in particular, its reporting on that very Oracle contract.

Lawson had gone so far as to withhold payment from Maximus because she was unhappy with three areas of its reporting. One of those was Oracle purchase orders.

"It is my understanding that among the topics to be discussed will be Maximus findings regarding the many Oracle POs and lack of detail SOWs, as I have told my management that those findings were at the heart of Carolyn's 'concerns,'" Kwong wrote in an email ahead of the Feb. 21 meeting.

But while the added flexibility is not unheard of for government projects that need to be completed quickly, the lack of oversight for such spending raised red flags with Kwong.

"I think Oracle will, indeed, make a tidy profit from the State's POs that demand no specific results from a number of Oracle business units," he wrote to Cummings.

Are answers on the way?

On Thursday in Medford and Salem, state Rep. Dennis Richardson, R-Central Point, is holding news conferences with U.S. Rep. Greg Walden, R-Hood River.

Though the size and scope are unkown, it's expected they'll announce a federal investigation into Cover Oregon.

Richardson recently called for the Government Accountability Office to look into it, and Walden serves on a committee that has launched other investigations of the Affordable Care Act.

Full coverage of the troubled Cover Oregon website: