Several Minnesota statutes require public employees to report to the Office of the Legislative Auditor (OLA) possible unlawful use of public money, property, or other public resources; unlawful access to or release of not-public government data; and noncompliance with certain state laws.1
The purpose of this document is to provide clarity regarding reporting expectations and recommended procedures for reporting to OLA. This guide is intended for organizations subject to OLA’s audit authority, including:
State agencies, boards, commissions, and other organizations in the Executive Branch.
Courts and other organizations in the Judicial Branch.
State colleges and universities.
Certain semi-state and metropolitan agencies.2
For simplicity, in this guide, we refer to entities subject to OLA’s audit authority as “organizations.”
In the sections below, we outline OLA’s guidance on who should report to OLA, what should be reported, when organizations should make reports, what should be included in the reports, and how reports should be made.
Public money or other public resources may have been used for an unlawful purpose.
Not-public government data may have been accessed by, or provided to, a person without lawful authorization.3
Theft, embezzlement, or unlawful use of public funds or property.4
Misuse of long-distance telephone service.5
Appointing authorities must report to OLA when there is probable cause of a substantial violation of Minnesota Statutes, Chapter 43A, which includes the code of ethics for employees in the executive branch.6
Minnesota statutes also encourage all state employees to report to OLA any actual or suspected violations of laws or rules governing grants and state contracts.7
Organizations must not prohibit nor discourage employees from reporting directly to OLA, and employees who report to OLA are protected by state law from retaliation.8 Employees may report concerns directly to OLA if they are uncomfortable reporting concerns internally, if they feel that their concerns were not addressed appropriately, or for any other reason.
Broadly, organizations must report to OLA when they obtain information or discover evidence of possible unlawful use of public money, property, or other public resources; unlawful access to or release of not-public government data; and noncompliance with certain state laws. “Unlawful use” means any use not authorized by law. “Evidence” may include information, documents, data, or other knowledge that give reason to believe that something is true or not true.
Under state law, organizations have the obligation to report to OLA at the moment they obtain information or discover evidence.9 Organizations subject to these reporting requirements must not wait to make required reports to OLA until they have conclusive evidence, until internal processes are concluded, or until information reaches a particular threshold (such as a preponderance of the evidence).
Further, these requirements apply to any evidence or information discovered or obtained at any time and through any means. This includes work completed by an organization in its regular course of business, including through standard compliance reviews, internal audits, or investigations.
Unauthorized or unlawful use of public funds, property, information systems, computer hardware or software, or other resources.
Bribery, embezzlement, forgery, theft, or other possible criminal activity involving public funds, property, or other resources.
Unauthorized access to or release of not-public government data, including data breaches and inadvertent disclosures of not-public data.
Violations of the code of ethics for employees in the executive branch, such as acceptance of gifts or favors, unlawful use of state property or time, and conflicts of interest.
Authorization or receipt of compensation for goods not received, services not performed, or hours not worked (time theft).
Spending in excess of appropriation authority.
Violation of laws or contractual obligations when conducting state business.
Employee misconduct, such as harassment or discrimination.
Investigations or discipline related to an employee’s job performance.
Policy violations that do not involve possible or actual misuse of public money, property, resources, or not-public government data.
The above lists are not intended to be comprehensive. If you or your organization are unsure whether a particular event is reportable, please contact Katherine Theisen, OLA Special Reviews Director, at Katherine.Theisen@state.mn.us or 651-296-1229; or Nathan Shepherd, OLA General Counsel, at Nathan.Shepherd@state.mn.us or 651-297-4364, for additional guidance.
Minnesota statutes require organizations to make reports “promptly.” Organizations should make reports as soon as possible, ideally within two business days of discovering or obtaining reportable evidence or information. However, for practical reasons, organizations may wish to consolidate some issues into weekly or monthly reports. See below for additional guidance on when to report certain issues.
Substantial misuse or loss of public funds, property, or other resources. For example:
Unauthorized transfers of funds.
Evidence or information of illegal or criminal activities.
Loss of property that significantly impacts normal operations.
Substantial violations of Minnesota Statutes, Chapter 43A.
Disclosures of not-public data involving a significant number of individuals, amount of data, or impact on daily operations or security.
Breaches of not-public data, meaning any “unauthorized acquisition of data maintained by a government entity that compromises the security and classification of the data.”10
Misuse or loss of public funds, property, or other resources that do not substantially affect the organization, such as a fraudulent transaction on a purchasing card for which the organization does not expect to be held liable.
Unintentional, purely accidental losses of state property that may have been used for an unlawful purpose. For example, a lost cell phone for which the organization is not certain whether the phone has been used for an unlawful purpose.
Disclosures of not-public data that do not involve a significant number of individuals, amount of data, or impact on daily operations or security.
Any information an individual or an organization believes is helpful to give sufficient context to the reportable activity should be included in the report to OLA. To help OLA understand the issue, organizations and individuals should aim to report the following to OLA:
What happened?
Who was affected?
When did the event occur?
Where did the event occur?
What was the dollar amount involved?
How and when did you find out what happened?
What are the organization’s next steps?
Please keep in mind that when making a report to OLA, organizations do not need to have all of the answers. We understand that a forthcoming investigation may provide additional information or clarity to the issue. When in doubt, contact OLA to discuss the issue, and staff will provide guidance specific to your situation.
OLA prefers that organizations submit reports in writing through e-mail at ola.complaints@state.mn.us, U.S. mail, or OLA’s online allegation form. You may also contact Katherine Theisen, OLA’s Special Reviews Director, directly at Katherine.Theisen@state.mn.us or 651-296-1229.
After receiving a report, a special review auditor will confirm receipt and may ask follow-up questions. OLA will then make a preliminary assessment to determine if further review by OLA is warranted.
