An Act To Expand the Auditing Powers of the Department of Audit and To Clarify the Confidentiality of Audit Working Papers and Information
Maine Legislature, Session 122, LD 1882
Committee: State and Local Government
Sponsors: BARSTOW, CUMMINGS, MUSE, SCHNEIDER
Amends: 5 MRSA §243, 5 MRSA §244-C, 5 MRSA §244-E

Legislative Document 
No. 1882 
H.P.1322 
House of Representatives, January 3, 2006 
An Act To Expand the Auditing Powers of the Department of Audit 
and To Clarify the Confidentiality of Audit Working Papers and 
Information 
Submitted by the Department of Audit pursuant to Joint Rule 204. 
Received by the Clerk of the House on December 28,2005. Referred to the Committee on 
State and Local Government pursuant to Joint Rule 308.2 and ordered printed pursuant to Joint 
Rule 401. 
Presented by Representative BARSTOW of Gorham. 
7r/~ 
1J7.17l~ 
MILLICENT M. MacFARLAND 
Clerk 
Cosponsored by Representatives: CUMMINGS of Portland, MUSE of Fryeburg, Senator: 
SCHNEIDER of Penobscot. 
Printed on recyckd paper 
Be it enacted by the People of the State of Maine as follows: 
Sec. 1. 5 MRS A §243, sub-§8, as amended by PL 1999, c. 208, 
§1, is further amended to read: 
8. 
Audit. To perform audits of all accounts and financial 
records 
of 
any 
organization, 
institution 
or 
other 
entity 
recelvlng or requesting an appropriation or grant from State 
Government and to issue reports on such audits at such times as 
the Legislature or the State Auditor may require; aBe 
Sec. 2. 5 MRSA §243, sub-§9, as enacted by PL 1999, c. 208, 
§1, is amended to read: 
9. 
Single audit. 
To 
conduct 
financial 
and 
compliance 
audits of financial transactions and accounts kept by or for all 
state agencies subject to the Single Audit Act Amendments of 
1996, 31 United States Code, Sections 7501 to 7507 (1998). 
The 
audits must be conducted in accordance with generally accepted 
governmental auditing standards ... ; and 
Sec.3. 5 MRSA §243, sub-§10 is enacted to read: 
10. 
InformatiQ~~tem audit. 
To 
conduct 
reviews 
and 
assessments of any computer system or network or security system 
established to safeguard a computer system that affects federal, 
state or local programs or quasi-governmental bodies subject ~ 
~t by 
the 
DepQLtment 
of 
Audit. 
Assessments 
of 
syst~l11 
vulnerability, network penetration, potential security breaches 
and susceptibility to electronic attack and electronic fraud are 
nonpublic and confidential pursuant to section 244-D. 
Results of 
the reviews that are not confidential may be released in the sQl~ 
discretion of the State Auditor. 
Sec. 4. 5 MRSA §244-C, sub-§2, as enacted by PL 1997, c. 703, 
§1, is amended to read: 
2. 
Information available to the Auditor. 
Notwithstanding 
any state law relating to the confidentiality of information, all 
information 
in 
any 
form 
in 
the 
files 
of 
any 
department, 
commission 
or 
agency 
of 
the 
State 
subject 
to 
an 
audit 
or 
investigation 
by 
the 
Auditor 
must 
be 
made 
available 
when 
necessary 
to 
the 
Auditor 
for 
performance 
of 
the 
Auditor's 
official duties. 
A. 
Before beginning an audit or investigation that may 
require 
access 
to 
records 
containing 
confidential 
or 
privileged 
information, 
the 
Auditor 
shall 
consult 
with 
representatives of the department, commission or agency to 
discuss methods of identifying and protecting privileged or 
Page l-LR2844(1) 
• 
confidential 
information 
in 
those 
records. 
During 
that 
consultation, 
the department, 
commission or 
agency shall 
inform the Auditor of all standards and procedures set forth 
in department, commission or agency policies or agreements 
to 
protect 
information 
considered 
by 
the 
department, 
commission or agency to be confidential or privileged. 
The 
Auditor shall limit access to information that is privileged 
or confidential by appropriate methodsT--wh-iGh--may--i:eelase 
eHaminin~-~€€~~4£-~~~-~~y~~-9~-~~J£~~~-~~-the 
seFa~tmentT-eemmissien-e~-a~eney. 
B. 
In making information available to the Auditor, 
the 
department, 
commission or agency that is subject to the 
audit or investigation or that provides the information may 
remove 
information 
that 
identifies 
individuals 
or 
institutions 
to 
protect 
privileged 
or 
confidential 
information, 
provided 
the 
information 
necessary 
for 
the 
Auditor 
to 
fulfill 
the 
Auditor's 
official 
duties 
is 
disclosed to the Auditor. 
If names are removed, 
another 
unique identifier must be inserted to enable verification of 
audit results. 
C. 
Documentary or other information obtained by the Auditor 
during the course of an audit or investigation is privileged 
or confidential to the 
same extent under 
law that that 
information 
would 
be 
privileged or 
confidential 
in the 
possession of the department, commission or agency providing 
the 
information. 
Any 
privilege 
or 
statutory provision, 
including 
penalties, 
concerning 
the 
confidentiality 
or 
obligation not to disclose information in the possession of 
any department, commission or agency or their officers or 
employees applies equally to the Auditor. 
Privileged or 
confidential information obtained by the Auditor during the 
course of an audit or investigation may be disclosed only as 
provided by law and with the agreement of the department, 
commission or agency subject to the audit or investigation 
that provided the information. 
D. 
If 
the 
Auditor 
accesses 
information classified as 
privileged 
or 
confidential 
pursuant 
to 
department, 
commission or agency policy or procedures or by agreement, 
the Auditor shall comply with the department, commission or 
agency 
standards 
or 
procedures 
for 
handling 
that 
information. 
The Auditor may include in the audit working 
papers only such excerpts 
from information classified as 
confidential or privileged as may be necessary to complete 
the audit, provided the use does not infringe on department 
policies or procedures applicable to the original provision 
of information. 
Sec. S. 5 MRSA §244-C, sub-§3, as enac ted by PL 1997, c. 703, 
§l, is amended to read: 
3. 
Confidentiality of audit working papers. 
Except as 
provided 
in 
this 
subsection, 
audit 
working 
papers 
are 
confidential and may not be disclosed to any person. 
PFieF-t.e 
~he--F&~~-~--~~-f4Ral--a~ai~-~~-~~~~~~-£e~£~7--~he 
A~Qi~9F-~~~-QiseFet.i9R-~~~~~-a~Qit.-~~~~~F&-~9 
~he-~~~r-~~~~~~-eF-~-~~~~--~9-~~-~~--9F 
iRvest.i~a~i9R-~-&~&-Qi6e~96~£e-~~~--ae~-p£ej~eiee-~~-a~Qit. 
F - - -i-n'J.e.s.t:..,i..ga-t-.i:on-.-- - -A~ t.e F - - -r-e-1e-a-se- - -9 E - - -t.-he- - - E iaal-- -aud-k- - -9 F 
iRves~i~a~i9a-£e~9£t.7-w~ki£~-~~~~-F&~&&G-as-ReeessaFY 
~9+ 
The Auditor has sole discretion to disclose audit working 
papers to the public at such time as the Auditor determines 
prudent 
whether 
before 
or 
after 
the 
final 
audit 
report. 
Confidential audit work papers may be released to the entities 
listed in this subsection without any breach of confidentiality 
or change in their nonpublic status: 
A. 
The department, commission or agency that was subject to 
the audit or investigation; 
B. 
Federal agencies providing a grant to the audited entity; 
C. 
Law enforcement agencies for the purpose of criminal law 
enforcement or investigations; SF 
D. 
Other auditors in their work reviewing the Department of 
AuditT1.. 
E. 
The Office of the State Controller; 
F. 
The Office of the Treasurer of State; 
G. 
A department, commission or agency, not the subject of 
the audit or investigation, that is directly affected by the 
audit working paper; or 
H. 
A department, commission or agency, not the subject of 
the audit or investigation, 
when the subject department, 
commission or agency agrees to the release. 
Sec. 6. 5 MRSA §244-C, sub-§4 is enacted to read: 
4. 
Confidentiality of tips or complaints. 
Notwithstanding 
Title L 
section 402 and any other state law regarding public 
records, all investigatory records of the Department of Audit, 
including any tips, 
complaints or information provided by an 
individual, pertaining to possible violations of statute, rule or 
regulation are deemed nonpublic. 
• 
Sec. 7. 5 MRS A §244-D is enacted to read: 
§244-D. 
Confidentiality of audits of information security systems 
In the event a 
review by the State Auditor indicates a 
computer system is vulnerable or security over the system is 
lacking, those findings may not be disclosed publicly and are not 
considered public records. 
Notwithstanding Title 1, section 402 
or any other provision of law to the contrary, the work papers 
developed in connection with the review of the computer system 
and the security over the system are deemed nonpublic records and 
are not subject to disclosure. 
The~te Auditor' s findings ~ 
be disclosed at the discretion of the State Auditor to the Chief 
Information Officer within the Department of Administratiye and 
Financial Services as well as the joint standing committee of the 
Legislature having jurisdiction over appropriations and financial 
affairs. 
Unless the State Auditor authorizes the release of 
information or findings gathered in the conduct of a review of 
computer system security, that information is deemed classified, 
confidential, secret and nonpublic. 
Sec. 8. 5 MRSA §244-E is enacted to read: 
§244-E. 
Power to compel production of evidence 
The State Auditor may conduct hearings, 
swnmon witnesses, 
administer oaths, take the testimony of such witnesses and compel 
the production, inspection and copying of documentary evidence, 
including without limitation evidence in electronic form, 
all 
software and hardware that hold data, are part of the technical 
processes leading up to retention of data or are part of the 
security system and documentary evidence that is confidential or 
not available to the general public, at such time and place as 
the State Auditor may designate for the purpose of investigating 
and 
determining 
the 
status 
of 
accounts 
and 
records 
of 
any 
~rtment of 
State 
Government. 
Notwithstanding 
any 
other 
provision 
of 
law, 
the 
State 
Auditor 
may 
inspect. 
compel 
production of 
and 
copy confidential 
information in any 
form 
unless the law making such information confidential expressly 
refers to this section and gualifies or supersedes it in that 
particular instance. 
The confide~~iality of information obtained pursuant to this 
section is as described in section 244-D. 
SUMMARY 
This bill clarifies the authority of the State Auditor to 
conduct information system audits and the confidential status of 
information system audit findings and workpapers. 
It 
clarifies 
that 
the 
State 
information in electronic form or in 
limitation on 
copying 
and 
removing 
agencies and commissions. 
Auditor 
another 
records 
has 
form 
from 
access 
to 
and without 
departments, 
It clarifies the discretion of the State Auditor to release 
nonconfidential audit working papers to the public before any 
final audit report. 
It allows the State Auditor to disclose, without any breach 
of 
confidentiality 
or 
change 
in 
their 
nonpublic 
status, 
confidential audit working papers to the Office of the State 
Controller, the Office of the Treasurer of State, affected state 
entities and other state entities if the audited department, 
commission or agency agrees to the disclosure. 
It 
makes 
investigatory 
records, 
including 
tips 
and 
complaints and information provided by an individual, related to 
possible violations of statute, rule or regulation nonpublic. 
It makes classified, confidential, secret and nonpublic any 
information resulting from 
a 
review by the State Auditor that 
indicates a computer system is vulnerable or security over the 
system is lacking. 
It 
gives 
the 
State 
Auditor 
the 
power 
to 
compel 
the 
production of evidence.