If you are a city or county administrator, there is a decent chance an auditor is looking at your contracts, has recently looked at your contracts, or is about to. And the audit reports coming out of jurisdictions across the country are almost identical in their findings: Reviews are uncovering contracts paid without validated invoices; grant recipients rated high-risk were never properly monitored; contract performance metrics were either never defined or never looked at; payment models were based on budgets and fixed monthly payments, not actual expenses. All while compliance teams ran with minimal staff and grant portfolios doubled or tripled during the pandemic.
In the Pacific Northwest, a county auditor found that nearly half of the grantees across a $1.8 billion portfolio were rated high-risk, with evidence of falsified invoices and payments to unapproved subcontractors. In one highly publicized case in California, a forensic audit uncovered a pattern of contracts steered without competitive bidding and procurement staff who felt they could not push back. In another jurisdiction, a $1.6 million contract was awarded without specifics of the service being provided. These are not edge cases. This is the pattern.
The federal picture tells the same story on a larger scale. The Government Accountability Office (GAO) reported $162 billion in improper payments across 68 programs in FY 2024, bringing the cumulative total since 2003 to $2.8 trillion. The GAO estimates annual losses from fraud between $233 billion and $521 billion. Those numbers get attention in Washington, but the dynamics are the same on a local level: rapid program growth without matching oversight capacity, and controls that were designed for a smaller, slower operation.
What makes this moment different
For local jurisdictions, several things are hitting at once. Pandemic-era funding is expiring, and jurisdictions that expanded programs with one-time federal dollars are now staring at structural deficits. Municipalities across the country are working to close budget gaps that in some cases run past $100 million. Every dollar in the contract portfolio is getting a level of scrutiny it hasn’t seen in years.
State legislatures are also tightening scrutiny. In California, new laws now require a majority of board votes before discretionary funds go to nonprofits, mandate disclosure of family ties before contract awards, and criminalize officials who direct contracts to organizations where their family members serve as officers. A county in the Pacific Northwest recently passed an ordinance requiring annual contractor reviews, immediate site visits when fraud is reported, and in-person check-ins every three years. Other states are watching and drafting similar measures. If your jurisdiction doesn’t have oversight legislation yet, it is probably coming.
From audit findings to a functioning oversight framework
In working with public agencies, we’ve seen a consistent pattern: the findings are almost always about basic blocking and tackling that was never documented or enforced. The solution is simple but not necessarily easy: documenting and validating key performance and financial indicators and taking action when performance indicators miss their targets. On a most fundamental level, this requires:
- Documenting policies for every stage of the contract lifecycle, from vendor qualification through closeout
- Establishing internal controls, including conflict-of-interest controls; disclosure requirements; independent reviews; and change-order controls with clear thresholds for re-approval when scope or budget shifts
- Enforcing invoice validation procedures with automated cross-checks and dual approvals
- Defining performance indicators at the point of award, measuring them throughout the life of the contract, and taking action when contractors miss their targets
- Establishing centralized contract management that operates independently from the programs it oversees
- Providing anti-fraud training for staff and financial management training and technical assistance for grantees
- Creating a reporting structure that gives oversight and governing bodies, senior leaders, management and the public ongoing visibility into how contracts are performing
The jurisdictions that have the most mature contract management capabilities are the ones that treat contract oversight as a management priority, not just a compliance response to bad headlines. The most successful ones invest in the human and technology infrastructure that allows robust contract oversight to be business as usual: a dedicated oversight function with real authority, a contract management lead who owns the framework, technology that helps smaller teams cover more ground, and a culture where the compliance function is respected, not resented.
At Protiviti, we help county and city supervisors develop or revitalize their contract and grant oversight structures by establishing governance frameworks, clarifying roles and accountability, strengthening monitoring and reporting processes, and implementing risk-based controls that improve transparency, compliance and performance outcomes. Learn more about our government services or contact the authors.
