Michigan Built a Monitor for $282.8M in Transfers, Didn't Run It

SIGMA is the enterprise system that runs Michigan state government's money: procurement, vendor payments, payroll, budgeting, and financial reporting for every state agency, moving $91.1 billion in expenditures and $91.8 billion in revenues in fiscal 2025 alone⧉.▸ A March 2026 performance audit⧉ by Michigan's Office of the Auditor General tested whether the controls guarding that flow actually work, and found five reportable gaps. The sharpest: SBO built a report specifically to monitor a transaction code that moves budget authority between state appropriations -- $282.8 million worth of transfers in fiscal 2024 alone -- and then, per the audit, didn't run that report from the day SIGMA launched in October 2017 until auditors raised the gap on August 28, 2025. The State Budget Office agreed with the finding and all four others.

Auditors analyzed all 287,510 of SIGMA's active vendor records⧉ as of August 25, 2025, and found 131,596 of them -- 46 percent -- had not received a single payment since at least October 3, 2017.▸ More than half of those dormant vendors, 70,054, were carried over from the state's prior accounting system when SIGMA replaced it; separately, 70,347 of the same dormant group were created in the vendor file before SIGMA even existed. SBO told auditors it is working with its vendor of record to design a process that archives inactive vendors after a set period, and noted that vendors must stay registered to bid on state solicitations even if they never get paid -- a legitimate reason some inactive accounts should exist. What the audit found missing is any process to tell the difference between those and the rest.

The audit's most pointed finding sits inside SIGMA's transaction-code architecture.▸ As of June 26, 2025, SIGMA ran on 213 active transaction codes, 74 of which carried no required approval workflow⧉. Auditors sampled 10 of those 74 and found one lets users transfer budget authorization between state appropriations with no compensating control at all -- $282.8 million moved through it in fiscal 2024. SBO told auditors a monitoring report for exactly this transaction code already existed. It just hadn't been run since SIGMA's October 2017 launch, meaning the report sat built and unused for close to eight years, until this audit surfaced the gap on August 28, 2025. SBO's response afterward was to confirm the transactions on record were properly entered and commit to using the report going forward.

Four of the ten sampled no-workflow codes had a related but distinct problem: they let interface or batch-processing accounts modify a transaction after it was already submitted, with no approval step covering the edit.▸ Auditors found approximately $3.3 billion in net credits moved through those four codes⧉ across fiscal years 2024 and 2025 combined. SBO's explanation was that these transactions originate in other systems where approval already happened -- but that doesn't cover the modification step the audit is describing, which happens inside SIGMA after the interface transfer. Separately, when auditors checked whether agencies were properly documenting the cases where they did bypass a required approval, 12 of 19 agencies reviewed had bypassed an approval during the sampled months, and 9 of those 12 -- three in four -- hadn't documented a sufficient reason why.

The audit's fourth finding turns from money to personnel.▸ State policy required agencies to remove a departing employee's SIGMA access -- to financial, budget, procurement, HR, and reporting functions -- within three business days of departure for most of the audit period. Auditors randomly sampled 60 of the 9,721 SIGMA users⧉ whose access was terminated between October 2023 and July 2025, and found 6 of the 60 -- 1 in 10 -- had actually left state employment between 5 and 139 days before their access was removed. SIGMA does have an automatic backstop that strips access once an employee's final payroll processes, but that runs weeks after departure; in the gap, a former state employee retains the ability to log in and process the same accounting transactions their old job required. Because the 60-user sample was drawn randomly from the full population of 9,721 terminated users, the same rate applied across that population would put roughly 972 departed employees in the same position -- an illustrative scaling this outlet calculated, not a figure the audit itself states or tested at that scale.

The State Budget Office agreed with all five findings⧉ and their recommendations in its preliminary response: build data-management controls over vendor data, ensure every registered vendor gets an IRS taxpayer-ID match, issue clearer guidance on documenting bypassed approvals, tighten the timeline for removing departed employees' access, and periodically reevaluate which transaction codes really need no workflow at all.▸ On the last point specifically, SBO told auditors it has begun developing a review methodology with a target completion date of June 2026 -- meaning, as of this audit's release, the review that would have caught the $282.8 million gap sooner was itself still a work in progress.