Washington County never formally centralized its technology services under one department, despite agreeing to do so in November 2022.
That finding comes from the county auditor's final follow-up on a 2022 information security audit, released Thursday, Sept. 17. County Auditor Kristine Adams-Wannberg's office found the county made progress on four of five audit recommendations but left the first and most foundational one unfinished.
Recommendation One called on the county administrator to formally establish and authorize the Information Technology Services Department as the centralized technology provider for all county agencies. County Administrator Tanya Ange agreed to the recommendation in a written response dated Nov. 28, 2022, and set a target completion date of March 2023.
That deadline passed more than three years ago. The September 2026 follow-up assessed the recommendation as not implemented.
County management agreed with the auditor's assessment, according to the report. Management said it chose a different approach that aligns with industry standards and supports the county's ongoing security work. The report does not describe what that alternative approach involves.
What the original audit found
The 2022 audit, published in November of that year, identified what it described as concerning deficiencies in the county's information security management and serious gaps in basic cybersecurity controls. The audit used the Center for Internet Security Controls framework to evaluate the county's practices.
The audit produced five recommendations, all directed at the county administrator. Beyond centralizing IT services, the recommendations covered establishing a security governance framework, hiring a qualified information security officer, proposing entity-wide security policies and implementing a formal security program.
The auditor's office rated the remaining four recommendations as in progress in the final follow-up. Some details of the county's security weaknesses were withheld from the public report under an Oregon public records exemption (ORS 192.345) and government auditing standards. A confidential version was provided to the county administrator and chief information officer.
Tracking progress since 2022
The auditor's office tracked the county's progress across three follow-up reviews: the first in April 2024, the second in May 2025 and the third in September 2026. The September report is the final review of the audit.
In her 2022 response to the original audit, Ange wrote that the county had selected a newer version of the cybersecurity framework and that implementation was well underway.
The auditor's office said in its final report that it appreciates the county's continued efforts. No further follow-up reviews are planned.
The county has not publicly detailed what its alternative to formal IT centralization looks like or when the remaining four recommendations might be fully implemented.
