(1) (a) The general assembly hereby finds and declares that:

(I) Improper payments are a serious problem for state agencies given the magnitude and complexity of state operations;

(II) Improper payments waste state and federal moneys and detract from the efficiency and effectiveness of state agency operations by diverting resources from their intended uses;

(III) An improper payment occurs when a vendor or other entity receives a payment from a state agency in error or in excess of the legal amount to which the vendor or other entity is entitled.

(b) The general assembly further finds and declares that:

(I) Recovery audits are a nationally recognized best practice for disbursements management and provide insight for improving operational efficiency and internal controls in the disbursement of state and federal moneys;

(II) In order to improve the economy and efficiency of state agency operations, it is necessary, appropriate, and in the best interests of the state to require the state controller to contract for recovery audits to recoup improper payments by state agencies of state or federal tax dollars, fees, gifts, grants, donations, and other state and federal moneys not specifically excluded by law or rule; and

(III) Recovery audits will not cost the state any money because the contractor's costs are deducted from any dollars recovered, which makes recovery audits self-funding.

(2) As used in this section, unless the context otherwise requires:

(a) "Consultant" means a private contractor that has recovery audit expertise.

(b) "Improper payment" means a payment by a state agency to a vendor or other entity that is made in error or is in excess of the amount to which the recipient is entitled, including, but not limited to:

(I) A payment to a recipient who does not meet applicable eligibility requirements for receiving the payment;

(II) A duplicate payment;

(III) A payment resulting from an invoice or pricing error;

(IV) A payment resulting from a failure to apply an applicable discount, rebate, or other allowance;

(V) A payment resulting from a failure to comply with a purchasing agreement; and

(VI) A payment resulting from any other inadvertent error.

(c) "Recovery audit" means a financial management technique used to identify improper payments made by a state agency to vendors and other entities in connection with the payment activities of the state agency.

(d) "State agency" has the same meaning as set forth in section 24-3-101. "State agency" does not include a state institution of higher education.

(3) (a) On or before July 31, 2017, and on or before July 31 of every third year thereafter, the state controller shall contract with one or more experienced consultants to conduct recovery audits for the period of three fiscal years that ends on the June 30 immediately preceding the applicable July 31 contracting deadline.

(b) A contract with a consultant entered into as required by paragraph (a) of this subsection (3) shall:

(I) Provide for reasonable compensation for the recovery audit services provided under the contract, which, notwithstanding any other provision of law, shall include compensation determined by the application of a specified percentage to the total amount collected by the consultant in the course of the consultant's recovery audit and related collection activities;

(II) Specify limitations on the scope of the powers that may be exercised by the consultant and procedures to be followed by the consultant in conducting recovery audits to the extent deemed necessary and appropriate by the state controller and the consultant to ensure that the due process rights of any person from whom the consultant seeks recovery of an improper payment are adequately protected; and

(III) Require any data or information determined by the state agency being audited to be confidential to be securely transmitted and maintained by the consultant in accordance with the security policies, standards, and guidelines established by the state chief information security officer or the state chief information officer pursuant to section 24-37.5-403.

(c) Notwithstanding any provision of law to the contrary and except to the extent prohibited by federal law or regulations or by an agreement between the state or a state agency and the federal government, the government of another state, or an agency or other government entity of another state, the state controller or a state agency being subjected to a recovery audit, and any contractor or vendor that has a contract with such a state agency, shall provide a consultant acting under a contract required by paragraph (a) of this subsection (3) with any confidential information in the custody of the state controller, the state agency, or the contractor or vendor that is necessary for the performance of the recovery audit. A consultant acting under such a contract, or any employee or agent of the consultant, is subject to all prohibitions against the disclosure of confidential information obtained from the state or the contractor or vendor in connection with the contract that apply to the state controller, the applicable state agency, the contractor or vendor, or an employee thereof and to all civil or criminal penalties that apply to a violation of any such prohibition.

(4) (a) The state controller shall require recovery audits to be performed on the payments to vendors and other entities made by all state agencies; except that the state controller may, subject to the review provided for in paragraph (b) of this subsection (4), exempt a state agency in whole or in part from the recovery audits otherwise required by this section if the state controller determines that a recovery audit is not likely to yield significant net benefits to the state or that the exempted state agency or portion of a state agency is already subjected to recovery audits under any federal law or regulation or state law, rule, or policy.

(b) For the 2014-15 fiscal year and for any fiscal year thereafter in which the state controller proposes to change the exemptions from recovery audits, the state controller shall provide a report of the proposed changes to the state auditor and the legislative audit and joint budget committees by the March 1 that immediately precedes the execution of one or more recovery audit contracts for the applicable fiscal year. The legislative audit and joint budget committees may veto any exemption from recovery audits proposed by the state controller by majority votes of the members of each of the committees taken before June 30, 2017, and taken before June 30 of each year thereafter in which the state controller proposes a change in the exemptions from recovery audits.

(5) The state controller shall reimburse federal agencies for any amounts recovered from federal programs in accordance with federal statutes, rules, and regulations. The state controller may retain a portion of the net amount recovered due to a recovery audit in order to reimburse the actual administrative costs, including reimbursement paid to other state agencies required by this subsection (5) and additional costs incurred by the state controller in contracting for and providing oversight of the recovery audit. The state controller shall reimburse any state agency that incurs additional costs in relation to the recovery audits for such costs from the portion of any amounts recovered from recovery audits of the state agency.

(6) (a) The state controller shall provide copies, including electronic copies, of any reports received from a consultant performing recovery audits pursuant to this section to:

(I) The governor;

(II) The state auditor; and

(III) The legislative audit and joint budget committees of the general assembly.

(b) The state controller shall provide the copies of reports required by paragraph (a) of this subsection (6) not later than the seventh business day after the date the state controller receives the consultant's report.

(c) Not later than June 30, 2018, and not later than June 30 of every third year thereafter, the state controller shall issue a report to the general assembly summarizing the contents of all reports received from consultants that performed recovery audits contracted for pursuant to this section. The report shall also be posted on the website of the state controller.

(7) Nothing in this section shall be construed to limit the authority of a governing board of a state institution of higher education to contract for a recovery audit for the institution it governs.

(8) Any moneys collected from a recovery audit pursuant to this section shall be transmitted to the state treasurer and credited to the recovery audit cash fund, which is hereby created in the state treasury. The cash fund shall consist of moneys credited to the cash fund pursuant to this subsection (8) and any other moneys appropriated or transferred to the cash fund by the general assembly. The general assembly shall annually appropriate the moneys in the cash fund to the state controller for the purpose of paying contingent contractor fees, state agency recovery audit costs, and amounts due to the federal government for moneys collected from recovery audits. All interest and income derived from the deposit and investment of moneys in the cash fund shall be credited to the cash fund. At the completion of each recovery audit cycle, the state controller shall transfer any moneys remaining in the cash fund to the general fund; except that the state controller shall instead transfer moneys remaining in the cash fund to the fund from which the improper payment was originally made if the state constitution specifies the purposes for which the moneys in that fund shall be used or if the improper payment was made with moneys originally received by the state as a fiduciary or as gifts, grants, donations, or custodial funds.

(9) The state controller shall manage all state agency recovery audits conducted pursuant to this section.