State Leadership Accountability Act Report, Biennial Period 2025

December 29, 2025 Tomiquia Moss, Secretary California Business, Consumer Services and Housing Agency 500 Capitol Mall, Suite 1850 Sacramento, CA 95814 Dear Secretary Tomiquia Moss, In accordance with the State Leadership Accountability Act (Leadership Accountability), the Department of Consumer Affairs submits this report on the review of our internal control and monitoring systems for the biennial period ending December 31, 2025. Should you have any questions please contact Kimberly Kirchmeyer, Director, at (916) 574-8200, Kimberly.Kirchmeyer@dca.ca.gov.

GOVERNANCE

Mission and Strategic Plan

The mission of the Department of Consumer Affairs (DCA or Department) is to provide outstanding support services, oversight, and innovative solutions to boards and bureaus that regulate California professionals and vocations so that through this partnership all Californians are informed, empowered, and protected. The following entities are within DCA's direct reporting responsibility:

• Arbitration Certification Program (ACP)
• Bureau for Private Postsecondary Education (BPPE)
• Bureau of Automotive Repair (BAR)
• Cemetery and Funeral Bureau (CFB)
• Bureau of Security and Investigative Services (BSIS)
• Bureau of Household Goods and Services (BHGS)
• Bureau of Real Estate Appraisers (BREA)
• Professional Fiduciaries Bureau (PFB) Through its strategic plan, DCA fulfills its mission by focusing on the following strategic goals:

1. Policy and Advocacy - DCA advocates on behalf of boards and bureaus by ensuring that
   statutes, regulations, policies, and procedures support and further the mandates and mission of DCA.

2. Communication - DCA provides resources, tools, and support for delivering relevant, timely,
   and accurate information.

Page 1 of 24

1. Organizational Effectiveness - DCA utilizes effective leadership, governance, and best
   practices to provide oversight and quality services to support the boards and bureaus.

2. Technology - DCA addresses business needs through creative, secure, and intuitive
   solutions.

3. Enforcement - DCA provides resources for its boards and bureaus to promptly protect
   consumers from harmful conduct by unlicensed and licensed professionals who pose a threat to the public's health, safety, and welfare.

4. Licensing - DCA provides resources for boards and bureaus to expeditiously license qualified
   applicants to allow timely entrance into the workforce, avoid establishing artificial barriers to licensure, and maintain consumer protection.

Control Environment

Unlike regulatory boards, DCA has direct authority over bureaus. The entities included under DCA's direct reporting responsibility are comprised of all DCA divisions, the Arbitration Certification Program, Bureau of Automotive Repair, Cemetery and Funeral Bureau, Bureau of Household Goods and Services, Bureau of Private Postsecondary Education, Professional Fiduciaries Bureau, Bureau of Real Estate Appraisers, and Bureau of Security and Investigative Services. The DCA Director supervises bureau activities, however, delegates authority to a bureau chief, who then carries out the Director's policies and decisions. DCA's Director is responsible for the overall establishment and maintenance of the internal control and monitoring systems. DCA's Internal Audit Committee is responsible for overall audit and review activities, including compliance with SLAA. The Internal Audit Committee is comprised of the DCA Director, Chief Deputy Director, Deputy Directors, and Senior Management. The Internal Audits Office provided a presentation and/or training to all executive officers and bureau chiefs on SLAA. The training included an overview of SLAA and the risk management process, management's role in SLAA, and an overview of the report template. Following the training, a meeting was held with DCA Deputy Directors to identify enterprise-wide risks. The discussion included newly identified risks and those in the prior SLAA Report. The Internal Audit Committee held an interactive discussion and identified the most critical risks to be included in the SLAA report. The Internal Audit Committee will provide support and guidance to direct DCA toward reducing the identified vulnerabilities. Evaluation of selected critical controls may be performed by the DCA Internal Audits Office if the effectiveness of these controls is in question. DCA's core values are accountability, communication, consumer protection, diversity, equity, inclusion, innovation, integrity, leadership, teamwork, transparency, and trust. DCA's Director,

Page 2 of 24

executive staff, and management team value having a high standard of integrity and ethics. DCA management establishes an effective control environment in the following ways:

• Establishment and demonstration of integrity and ethical values is done through the ethics
  training requirement and completion of the Form 700. Additionally, staff are made aware of the Whistleblower Act and the process to make a complaint with the process clearly defined for all staff on the DCA Internal Audit Office intranet. The Department drafts and maintains policies, including acknowledgement forms to demonstrate its position on integrity and ethical values.

• The management philosophy and operating style is supported and dictated through regular
  meetings among executive staff and trainings.

• The organizational structure is detailed on organizational charts for each bureau and
  program within the Department. Employees are made aware of their role, as well as the reporting structure.

• Documentation of the control system is maintained through departmental memorandums,
  policies, and unit policies and procedures. In order to maintain a competent workforce, the Department has a workforce succession plan, adheres to training requirements of all employees, and has an established training solutions program that provides or coordinates department-wide training to staff, as needed. Enforcement of accountability is facilitated through annual reporting to control agencies and the Legislature, and public board meetings. Additionally, each year, the Legislature holds joint Sunset Review oversight hearings to review DCA boards and bureaus. The Sunset Review process allows the Legislature, DCA, the boards and bureaus and their stakeholders to discuss their licensing, enforcement and administrative performances and make legislative changes to improve their functionality. The Legislature determines the length of time until the next review. They can request the board or bureau return for Sunset Review again between one to four years. On an individual basis, oversight and accountability is also achieved through the use of the DCA's human resources, fiscal operations, legal affairs, internal audit, and equal employment opportunity offices. DCA provides these services to its divisions and 36 boards and bureaus. The Director hosts regular, quarterly meetings with Bureau Chiefs, Executive Officers, and Board Presidents and Vice-Presidents. Periodical meetings on topics of interest to the boards and bureaus, as well as Cabinet meetings with Executive Officers and Bureau Chiefs are also held as needed. These meetings allow DCA leadership to quickly ascertain risks, develop strategies to mitigate potential issues that may arise, and efficiently educate leadership on processes to achieve implementation uniformity across the Department. Routine communication with board and bureau leadership is critical to effective oversight of the mission of consumer protection at DCA.

Page 3 of 24

In addition to establishing a department-wide control environment, DCA's bureaus also maintain their own effective control environments. Bureau Chiefs, along with their Deputy Chiefs and management team, exercise the highest levels of integrity and ethical values in performing the daily oversight of operations and strategic implementation of policies and procedures. This is accomplished by disseminating and adhering to the procedures for program operations, leading ethically by example, and making decisions based in law that reflect good business practices. Bureau management teams enforce accountability by ensuring that all staff are appropriately trained and by holding regular division or one-on-one meetings with their staff. This provides an open dialogue when anyone has a concern, ethical or otherwise. Guidelines and expectations are distributed to all staff to provide a consistent and clear path for staff to succeed. Bureau staff reflect their bureaus' core value of consumer protection. Staff and management are all encouraged to share ideas to streamline and improve processes where possible. Further, staff are encouraged to notify management when they discover potential vulnerabilities or risks and to submit ideas and engage in productive discussions.

Information and Communication

DCA has identified Kimberly Kirchmeyer, Director, and Christine Lally, Chief Deputy Director, as the Executive Monitoring sponsors. They are members of the Internal Audit Committee and will facilitate and verify that the internal control monitoring practices are implemented and functioning as intended. DCA is required to collect and communicate information about operational, programmatic, and financial decision-making via several reporting mechanisms. For example, incremental budget changes, organizational charts, and position lists are sent monthly to the Budget Office and Office of Human Resources within the Office of Administrative Services. In addition, business continuity plans, workplace inspection reports, equipment purchases, fleet management reports, and emergency preparedness and evacuation plans are provided on a quarterly or annual basis, depending on respective authority. DCA also maintains a Policy Review Committee to ensure relevant policies and departmental procedures memorandums (DPMs) are updated to reflect current mandates as well as the development of new policies and DPMs in response to new mandates. DCA divisions and units have dedicated staff (e.g., HR and training liaisons) to facilitate communication across all staff and management. DCA Executive leadership meet weekly to ensure communication is shared and can be passed to subordinate staff, as necessary, to ensure communication is transferred to all levels of staff when changes are made or updates are needed.

Page 4 of 24

DCA maintains a Board and Bureau Relations team to facilitate communication across organizational lines, actively participate in board and bureau public meetings, monitor policy issues and decisions, and host Director Quarterly meetings with all boards and bureaus. DCA executive staff also have regular meetings with the Business, Consumer Services and Housing Agency, the Governor's Office, control agencies, legislative staff, and interested parties. DCA staff meets with external stakeholders. In conjunction with DCA, boards, bureaus, committees, and commission staff also meet with external stakeholders to gain various perspectives in order to efficiently craft policies, legislation, or regulations that impact the regulated profession. DCA employees are encouraged to report inefficiencies and inappropriate actions to management and other decision makers using their respective chain of command or as instructed within applicable policies. For example, ISO 20-01 Acceptable Use of Information Technology Systems; Legal 23-01 Incompatible Work Activities; EEO 25-03 Non-Discrimination Policy and Complaint Procedures, and EEO 25-02 Sexual Harassment Prevention Policy, provide direction for reporting inefficiencies and inappropriate actions. DCA employees can report alleged threats or acts of workplace violence to the Division of Investigation (DOI), Special Operations Unit (SOU) in accordance with DCA's Workplace Violence Prevention Policy DOI 24-01. DCA maintains the Internal Audit Office and the Equal Employment Opportunity Office for reporting inefficiencies and inappropriate actions, including the annual posting of the Whistleblower poster and brochure from the California State Auditor's Office. DCA is committed to providing a safe and healthful work environment and provides the services of DCA supervisors/managers, DOI SOU, and OHR to assist in resolving workplace conflicts. All DCA management addresses concerns immediately, fairly, and in accordance with required policies. All ideas are welcomed, training is encouraged, and mutual respect is demonstrated by all staff. The Director and Chief Deputy Director accept honest mistakes and encourage staff to report them so action to rectify a problem can be taken immediately. It is encouraged that any backlogs or concerns within a DCA unit, board, or bureau be forwarded immediately so DCA can expeditiously resolve or assist with the issue.

MONITORING

The information included here discusses the entity-wide, continuous process to ensure internal control systems are working as intended. The role of the executive monitoring sponsor includes facilitating and verifying that the Department of Consumer Affairs monitoring practices are

Page 5 of 24

implemented and functioning. The responsibilities as the executive monitoring sponsor(s) have been given to: Levi Hull, Compliance and Equity Officer. DCA leadership ensures that knowledgeable, experienced managers are hired and empowered to carry out the responsibilities of their units. Regular meetings occur to review performance and potential risks. Enterprise-wide issues are assigned to executive or senior staff, who may be assisted by other lead staff, to ensure resolution. DCA management works closely and meets regularly with staff and liaisons at DCA internal units, boards, and bureaus to ensure that all processes and procedures are followed. Key metrics are reviewed periodically to identify potential issues to escalate to executive or senior staff for resolution. When a lack of clarity is identified with an issue, processes are amended or further developed. When issues are resolved, the resolution is documented to provide a historical record for potential future issues that may be related. Control agency requirements are appropriately coordinated with key staff throughout DCA to ensure compliance with state administrative procedures. Additionally, DCA regularly reports to these agencies point-in-time status updates as needed. DCA's Internal Audits Office also serves as a resource to ensure that DCA and its boards and bureaus follow appropriate processes when carrying out mandated duties. Further, controls over DCA programs and processes are routinely reviewed by its Internal Audit Office based on an annual risk assessment process. Additionally, the audit committee can submit requests to have an audit scheduled for a board, bureau, or program, or process, that perhaps is not achieving its objectives or where risks levels have been elevated. Moreover, the DCA's various divisions, boards, and bureaus undergo audits and reviews from numerous external state oversight agencies regularly. DCA management considers the results of both internal and external reviews to identify opportunities for continuous improvement.

RISK ASSESSMENT PROCESS

The following personnel were involved in the Department of Consumer Affairs risk assessment process: executive management, middle management, front line management, and staff. The following methods were used to identify risks: brainstorming meetings, employee engagement surveys, ongoing monitoring activities, audit/review results, other/prior risk assessments, questionnaires, consideration of potential fraud, and performance metrics. The following criteria were used to rank risks: likelihood of occurrence, potential impact to mission/goals/objectives, timing of potential event, potential impact of remediation efforts, and tolerance level for the type of risk.

Page 6 of 24

RISKS AND CONTROLS

Risk: Operational Inefficiencies Due to Siloed Licensing and Enforcement Practices Across Boards and Bureaus.

Two of the most important functions of DCA boards and bureaus are maintaining a licensure program to ensure individuals are minimally qualified to practice and conducting enforcement activities and disciplinary proceedings when necessary for consumer protection. Due to the complexities involved, both licensing and enforcement can be lengthy and costly endeavors for boards and bureaus. A lack of information sharing between boards and bureaus regarding licensing and enforcement best practices may lead to inefficiencies that could be reduced or eliminated.

Control: Control A: Data Governance

To ensure that work is being completed timely and correctly, valid and accurate reports are necessary. DCA and its boards and bureaus report licensing and enforcement statistics on a quarterly and annual basis. Additionally, as stated previously, boards and bureaus also undergo regular reviews before the Legislature, which require a lengthy Sunset Review Report that contains a significant amount of statistical reporting. Configuration updates are required to ensure a uniform approach to data reporting. This includes identifying best practices for licensing and enforcement, identifying potential gaps in business processes at individual boards and bureaus, and implementing procedure manuals for staff to uniformly track licensing and enforcement milestones. DCA will convene work groups to perform a similar review to that of the Annual Report metrics for the Sunset Review Report to further refine definitions and standard tracking based on identified best practices. New reports for all systems will be developed, tested, and approved based on the agreed upon uniform definitions and tracking standards.

Page 7 of 24

Control: Control B: Model Procedure Manuals

DCA will work with boards and bureaus and with the enforcement and licensing user groups to establish a model procedure manual. These manuals will be provided to the boards and bureaus so they can add in their own specific requirements. In addition, as changes happen in the systems or new codes are added, the procedure manuals will be updated.

Control: Control C: Continuous Process Improvement

DCA has been exploring different ways to create best practices for licensing and enforcement that incorporates knowledge and lessons learned from all of its boards and bureaus. One new approach has been the launching of the Enlighten Projects. The initial Enlighten Licensing Project was completed with the Board of Registered Nursing (BRN) and the Enlighten Enforcement Project is near completion with the Dental Board of California (DBC). In this endeavor, subject matter experts review the processes of a board or bureau in order to identify ways to make its processes more efficient, cost-effective, information- technology-forward, and streamlined. Representatives from all boards and bureaus have an opportunity to participate in the project and provide feedback on how the individual board or bureau conducts its work and provide recommendations. The Department is also relaunching the DCA Enforcement Academy in the first quarter of 2026. The Department has brought together SMEs to help identify improvements to the Academy curriculum and will be reinstituting the week-long training as it was initially established in 2010. The Academy will provide high-level best practices that can be applied by enforcement staff at all boards and bureaus as well as give them a good foundation on understanding the entire enforcement process. The Academy will also be conducted in collaboration with resources from the Office of the Attorney General and the Office of Administrative Hearings.

Page 8 of 24

DCA executive staff also holds regular meetings with executive officers and bureau chiefs both monthly and quarterly. These meetings provide a platform for leadership at DCA and the boards and bureaus to share information on best practices they have developed for licensing and enforcement.

Risk: Succession Planning

DCA's current Workforce Development and Succession Plan is set to expire in 2026, requiring a new plan to be developed that year. The COVID-19 pandemic significantly impacted key programs like the Future Leadership Development (FLD) Program and the Mentoring Program, leading to their discontinuation. Compounding these challenges, many boards and bureaus have experienced extended vacancies in crucial leadership roles, some lasting over six months. The difficulty in recruiting for these positions is further exacerbated by the fact that no single unit within DCA currently oversees succession planning activities.

Control: Control A: Develop and Implement a New Workforce Development and Succession Plan

The development of DCA's new Workforce Development and Succession Plan in 2026 will be a data-driven and inclusive process. The Compliance and Equity Officer will coordinate with key DCA units, notably the Office of Human Resources (OHR) and SOLID Training and Planning Solutions, to collect and analyze critical information and workforce data. Once a comprehensive draft is prepared, it will undergo a thorough internal review. Subsequently, the plan will be presented to the Executive Officer and Bureau Chief Cabinet to solicit their expert feedback, ensuring the final version aligns with strategic objectives.

Page 9 of 24

Control: Control B: Institute DCA Programs to Address Succession Planning Needs

To strengthen succession planning at DCA and its boards and bureaus, the Compliance and Equity Officer will collaborate with SOLID's Training and Planning Solutions unit. This partnership will focus on two key areas: reactivating impactful previous programs and identifying innovative new programs. The overarching objectives of these initiatives are to boost staff retention rates and systematically prepare employees for advancement, including future leadership roles within DCA divisions and affiliated boards and bureaus.

Risk: AI/GenAI Adoption: Navigating Risks

The use of Artificial Intelligence (AI), including Generative AI (GenAI), at the California Department of Consumer Affairs (DCA) introduces potential risks related to data privacy, algorithmic bias, procurement compliance, and operational transparency. Without appropriate governance, these risks could undermine public trust, violate regulatory obligations, and expose the Department to legal and reputational harm. However, when implemented responsibly, AI also presents significant opportunities to enhance operational efficiency, modernize service delivery, and improve workforce readiness.

Control: Control A: Procurement Compliance Controls

Ensure all DCA solicitations and contracts--IT and non-IT--must include a GenAI disclosure clause and require vendors to submit the STD 1000 GenAI Disclosure and Factsheet. Failure to comply results in disqualification or contract nullification. This control ensures transparency and risk assessment of third-party AI tools before deployment.

Page 10 of 24

Control: Control B: Access Control

Disable user access to all non-approved, AI/GenAI platforms and functionality.

Control: Control C: Leadership Development in AI Strategy

Participate in trainings, conferences and forums that will enhance current DCA leadership's ability to lead and form appropriate strategic direction. Such engagement may include sessions on designing AI strategies, using change management models, and identifying organizational opportunities for AI integration.

Risk: Data Security

The Department of Consumer Affairs (DCA) faces significant risks related to the confidentiality, integrity, and availability of its information assets. These risks stem from increasing cyber threats, evolving regulatory requirements, and the complexity of managing sensitive consumer and licensing data across decentralized systems. Failure to implement and maintain robust data security controls could result in data breaches, service disruptions, reputational damage, and non-compliance with state and federal mandates.

Control: Control A: Reduce Known Risk

DCA manages security risk on a Plan of Actions and Milestones (POAM) that is submitted quarterly to the California Department of Technology (CDT). Risks are recorded from operational scans, audits and assessments performed by third parties. DCA will remediate all 'critical' and 'high' risks within the same quarter, while reducing all other risks by 10% annually.

Page 11 of 24

Control: Control B: Infrastructure Change Control (ICC)

Weekly ICC meetings serve as a governance checkpoint for all infrastructure changes, including those affecting data security. These meetings ensure that proposed changes are reviewed for risk, compliance, and alignment with enterprise architecture.

Control: Control C: Audit and Risk Reporting

DCA participates in regular cybersecurity audits and submits executive dashboards to the California Department of Technology (CDT). These dashboards track risk scores, project criticality, and compliance with NIST-aligned controls. DCA will increase performance and scores for the biennial audits and assessments performed by the CA Department of Technology and the CA Department of the Military.

Control: Control D: Targeted Phishing Campaign

Increase the data security resilience of departmental staff by enhancing phishing campaigns and user training in the areas of social engineering and risk identification.

Risk: ACP - Business Modernization

The Arbitration Certification Program's (ACP) current tracking system does not meet the data tracking needs of the program. Currently, data provided by the certified programs is manually input into several excel spreadsheets. Data is then pulled from spreadsheets for use in reporting and tracking data. This method is challenging when tracking data for

Page 12 of 24

public reports and identifying priority time sensitive workload. This could result in ACP gathering mandated data that may be incomplete or inaccurate.

Control: Pursue Business Modernization Project

This risk was identified in the 2024 SLAA Report and is in process but has not been completed due to budget constraints and staffing changes. The ACP has initiated a request with the Department's Organizational Improvement Office and Office of Information Services to develop a business modernization project plan to identify a new system to support existing business processes. ACP has updated, created, and implemented new internal procedures to standardize work performed by staff across all programs. While ACP processes were previously mapped in 2022, with changes to workflow and requirements, mapping will need to be updated. These procedures will identify specific ACP processes to be addressed in the business modernization efforts.

Risk: BAR - Consumer Use of Artificial Intelligence

Consumers are increasingly using artificial intelligence (AI) tools to generate or support complaints submitted to the Bureau. Because AI can provide inaccurate or misleading information, consumers may believe AI outputs over official Bureau guidance. This increases the risk of incomplete, inaccurate, or frivolous complaints as well as complainants who have expectations outside the jurisdiction of the Bureau. It also strains Bureau resources and could distort complaint data and negatively impact licensees.

Control: Website Enhancements

The Bureau is updating its complaint form and website content to provide clear, accurate, and accessible information about the complaint mediation and enforcement processes. This will help set expectations, reduce reliance on

Page 13 of 24

AI-generated misinformation, and direct consumers to official Bureau resources as the authoritative source.

Risk: BHGS - Structural Deficit

The Bureau is currently running a structural deficit and is projected to have only four months in reserve by fiscal year 2026-27. As a special fund, the Bureau receives no funding from the State's general fund. Rather, all revenue comes from the entities the Bureau regulates and the majority of that derives from licensing fees where legislative action is necessary to raise statutory fees in order to increase revenue.

Control: Expenditure Monitoring and Study

1. Closely monitor budget allocations to implement cost savings measures and
   further reduce unnecessary expenditures.

2. Prior to the next Sunset Report, the Bureau will conduct an audit/fee study to
   determine if fees for various license types and transactions need adjustment.

Risk: BHGS - Staff Retention

The Bureau is a small program of less than 70 staff. Retirements and staff turnover continually result in vacancies that deeply affect staff workload and morale.

Page 14 of 24

Control: Prioritize positive working conditions to make the Bureau an attractive and competitive employer.

1. Executive management has prioritized hiring for all Bureau managers.

2. Maintain a strong team of leaders and professionals by promoting staff
   development and engagement.

3. Support upward mobility opportunities for staff through ongoing training,
   cross-training, and mentoring.

Risk: BPPE - Fiscal Sustainability

The Bureau for Private Postsecondary Education has had a structural deficit for the last decade, with revenues generated falling far short of statutorily obligated expenditures. Increases to application fees as well as the annual fees paid by institutions holding approval to operate are essential to ensuring the Bureau's continued ability to perform required functions and protect consumers enrolling in private postsecondary educational institutions.

Control: Align Revenues with Required Expenditures

In collaboration with DCA's Budgets Office, the Bureau is working on updated financial projections and fee analyses to determine the levels of fee increases needed for fiscal sustainability. The Bureau expects its financial situation to be under discussion by the Legislature during its 2026 Sunset Review Process, with updated modeling used to inform future fee proposals.

Page 15 of 24

Risk: BPPE - Data System Implementation

Following several years of planning and development, the Bureau transitioned from its longstanding data system of record to a new system, Connect, in June 2025. This system has the potential to streamline operations and create efficiencies, for both the Bureau and institutions, but additional developments and refinements are necessary to provide required functionality and to maximize system potential.

Control: Enhance and Evolve the Connect System

In close coordination with DCA's Office of Information Services (OIS), the Bureau is maintaining significant staff focus on system development beyond system conversion to ensure that continued efforts are appropriately prioritized, monitored, tested, and implemented. Because development needs are likely to extend for the near future, the Bureau is currently working to convert an existing analytical staff position to a position with greater technical skills and capabilities needed for data system monitoring and support.

Risk: BHGS - Tenant Improvements and Lease Renewal

The Bureau's facility lease is set to expire and rent for its current headquarters is likely to double. The Bureau also has unique building requirements because it maintains a chemical and flammability laboratory that necessitate specific storage, ventilation, and filtration requirements. Much of the special equipment used for testing in the Laboratory is old and in need of replacement.

Page 16 of 24

Control: Monitor Provisions of Lease and Tenant Improvements.

The Bureau is fully engaged and participating in frequent discussions with DCA facilities and the Department of General Services in negotiating a renewed 15-year lease and to determine what tenant improvements must be made.

Risk: BREA - Diminishing Licensee Population

Due to the real estate market volatility and other real estate appraisal industry trends, the licensee population is diminishing. This downward trend has a direct impact on the Bureau of Real Estate Appraisers' (BREA) revenue since it is a special fund entity that relies solely on licensing and regulatory fees to operate. Over the last ten years, BREA's licensee population has decreased approximately 25%. Another crucial element of the diminishing licensee population is the age demography. About 71 percent of the current population of licensed appraisers is estimated to be over 50 years old.

Control: Increase access to the profession through the approval of additional pathways to licensure.

BREA licensure approval process requires candidates to complete qualifying education, experience, and the passage of a national exam. The requirements by the Appraiser Qualification Board requires a minimum of 1000 hours of experience to sit for the national exam. BREA has created an internal subject matter expert team to review and approve Practicum Programs created for aspiring appraisers. While the length of time to complete a program is a sizable commitment of time by an applicant this additional pathway will provide California a significant pipeline to the profession, thus addressing the aging and diminishing licensee population.

Page 17 of 24

Risk: BREA - Hiring qualified professionals to support the Enforcement Unit

The Enforcement Unit within BREA is currently comprised of the Property Appraiser/ Investigator, Senior Property Appraiser/Investigator, and Supervising Property Appraiser classification series. All these classifications currently require a current valid appraiser's license and qualified educational background to be eligible to serve in the BREA Enforcement Unit. BREA's candidate pool remains inefficient in attracting qualified candidates, thus, leaving extended vacancies and workload shortages.

Control: Creating new job qualifications and support services

To address the workload, the Enforcement Unit has begun strategies to utilize contract services to focus on cases over one year old. In addition, the Bureau has begun to look at contracting with subject matter expert licensees who could work with an individual during the investigation to provide expertise in the appraisal field. The Bureau could reclassify positions to a non-licensed investigative classification as an alternative to provide investigative services, very similar to other boards and bureaus. Lastly, the Bureau is exploring the possibilities of incorporating Artificial Intelligence to assist in the process. These combined efforts could address the needed professional support for investigating complaints through a different process.

Risk: BSIS - Insufficient Succession Planning and Staff Training

Nearly the entire management team at the Bureau has turned over in the last three years, highlighting the need for complete training processes, job aids, and succession planning. Inadequate staff and managerial training along with excessive vacancies can lead to errors, non-compliance with regulations, and reduced operational efficiency, potentially resulting in financial loss or legal liability. Additionally, in the last ten years the Bureau has

Page 18 of 24

had significant legislative changes, increasing workload and complexity for Bureau staff and managers. The Bureau regulates 27 different license types and approximately 450,000 licensees. The Bureau's licensing staff process over 190,000 applications each year, reviews and processes licensing-related documents (name changes, address changes, requests for baton rosters, requests for duplicate licenses, etc.), and responds to the many e-mails received daily. The intricacy and volume of the work is a challenge for staff, which is compounded by a lack of time for proper training and regular retraining to keep skills fresh and identify any gaps. As a result of the lack of staff and training, the Bureau has been experiencing high turnover of staff. Due to vacancies, work has been redistributed to existing personnel, resulting in higher workloads and a demonstrated need for further training and staffing resources.

Control: Internal Comprehensive Employee Training and Education

The Bureau is committed to building a strong and sustainable workforce through continuous investment in professional development. This includes ensuring supervisors and managers receive onboarding, ongoing training in hiring practices, employee coaching, and performance management training. Enforcement staff are provided opportunities for advanced investigative training, peer mentoring, and job shadowing to strengthen technical and procedural expertise. Management continues to empower employees by setting clear expectations; providing the tools, onboarding plan, and resources necessary for success; and maintaining open communication on workload priorities. These practices help sustain motivation, accountability, and high-quality enforcement outcomes. As part of its succession planning efforts, Bureau management is identifying critical positions and capturing institutional knowledge through updated desk manuals, onboarding plans, training guides, and expanding cross-training to ensure operational continuity during vacancies or transitions. By proactively developing future leaders and enhancing staff capacity, the Bureau is strengthening its long-term ability to meet enforcement goals and maintain consistent public protection statewide.

Page 19 of 24

To further strengthen oversight capacity, the Bureau will complement the SOLID and CalHR trainings and implement an in-house structured training program for its staff. The program would include a mandatory onboarding, ensuring all new employees understand the Bureau's mandate, legal framework, and operational procedures from day one. To keep staff up to date, periodic refresher courses would be introduced, focusing on legislative changes, compliance trends, and ethical standards. Recognizing the unique demands of different roles, the Bureau would also develop role-specific training for inspectors, licensing officers, and investigators. All Bureau-led training activities would include a comprehension assessment and evaluations. Results could be reviewed regularly by the Training Unit to identify gaps, improve content, and ensure continuous development. This structured approach would help build staff confidence, reduce performance errors, and improve regulatory consistency across the Bureau.

Risk: BSIS - Staff Turnover and Vacancies Create Risk and Delays in High Value Units

The private security industry has grown substantially over the past 10 years. To wit:

• In FY 2015-16, the Bureau had approximately 320,000 licensees, which grew to over
  450,000 in 2024-25.

• Proprietary security officers grew over 66% in the same time.

• Private patrol operators (security companies) grew 44%.

• Security guards increased 22%.
  This growth, along with the increasingly complex directives from the legislature, has resulted in Bureau employees growing from approximately 50 employees to over 70 in the same ten-year time frame. The Company Licensing Unit, which processes the most complex and high-cost applications, is at risk for delayed application processing and delayed communications to the public, applicants, and licensees due to lack of staff positions/fulfillment. One position was lost due budget reduction, and a second position is vacant. A third position that is filled has an individual out on an extended Leave of Absence.

Page 20 of 24

The workload in the Company Licensing Unit is intricate and involves numerous moving parts. Most company applications often take weeks to process due to various delays and deficiencies that occur with these complex applications.

Control: Recruitment and Retention

The Bureau will evaluate the workload and staffing in the Company Licensing Unit to determine if additional staff are needed to meet stated processing timeframes and provide adequate customer service. Bureau management will implement a robust and proactive recruitment effort, targeting recently terminated federal employees, participating in job fairs, and advertising in non-traditional publications. Bureau management are exploring in-house activities aimed at raising employee participation such as office celebrations, competitions, SOLID morale-building classes, along with individual unit morale building. The Bureau will review the company licensing process and determine if there are ways to streamline the review and evaluation of these applications and make the process more efficient.

Risk: CFB - Technology--Support, Tools, Design, or Maintenance

All of the Bureau's Audit Unit operations are manually tracked. All the work conducted by the Audit Unit is tracked via various spreadsheets and there is not a centralized location for the status of an audit or audit statistics. Each month, quarter, and year, audit statistics must be manually gathered and compiled.

Page 21 of 24

Control: Workload Tracking and Automation Controls

The Bureau is always looking for ways to increase efficiency and effectiveness. Many applications are available to staff to assist with tracking workload and communication, and developing templates and documents (i.e., Lists, OneDrive, OneNote, Planner, Power Automate, Stream, To Do) and are available through the DCA App Portal. Training for these apps is limited and only available from external sources. CFB is also involved in the development of a new software platform, CFB Connect, to automate some audit functions such as the submission of annual and quarterly reports. However, the Bureau will need additional funds in order to move forward with an audit software platform. Once additional funds are available, the Bureau will continue looking into the audit software.

Risk: CFB - Care and Maintenance for Unlicensed/Abandoned Cemeteries

Unlicensed and abandoned endowment care private cemeteries have no statues or regulations mandating what happens to the unlicensed cemetery property once the certificate of authority (cemetery license) is canceled, revoked or surrendered.

Control: Continue the Discussion and Allow the Legislature to Act and Create Statutes

The passage of SB 777 (Richardson, Chapter 658, Statutes of 2025) Abandoned cemeteries; report, amended BPC section 7612.12, which accelerated the due date to convene a workgroup on or before March 1, 2026 to discuss options for ensuring continued care, maintenance, and embellishment of abandoned cemeteries, including the possibility of requiring counties to assume responsibility for maintenance, irrigation, public works, and burial services for cemeteries

Page 22 of 24

located within their boundaries that become abandoned. The Bureau is required to submit a report to the Legislature summarizing the discussions of the workgroup and its recommendations no later than June 1, 2026.

Risk: CFB - Funding - Sources, Levels

The Bureau is self-funding and receives no funds from the State's general fund. The only source of funding is from licensing fees, an additional regulatory fee for interment, cremation, hydrolysis and reduction, and enforcement efforts. With the current budget, the Bureau cannot submit proposals for new staff or new technology to streamline processes to further improve CFB functions.

Control: Workforce Prioritization and Staffing Management Controls

The Bureau regulates 14 different licensing categories totaling over 10,000 licenses. In addition, the Bureau oversees over $3 billion in cemetery and funeral trust funds. During FY 2024-2025, the Bureau had to delay recruitment for three vacant positions due to budget constraints. The Bureau operates on a structural imbalanced budget and is expecting to be insolvent by FY 2026-2027. The Bureau Chief will work closely with the Departments Budget Office to determine next steps in seeking a fee increase.

Page 23 of 24

CONCLUSION

The Department of Consumer Affairs strives to reduce the risks inherent in our work and accepts the responsibility to continuously improve by addressing newly recognized risks and revising risk mitigation strategies as appropriate. I certify our internal control and monitoring systems are adequate to identify and address current and potential risks facing the organization.

Kimberly Kirchmeyer, Director

CC: California Legislature [Senate, Assembly] California State Auditor California State Library California State Controller Director of California Department of Finance Secretary of California Government Operations Agency

Page 24 of 24