(a) To establish a state high risk list, the State Auditor shall perform an assessment to determine the state agencies and statewide issues that should appear on the list.

(b) If the State Auditor previously identified a state agency or statewide issue as being high risk, the State Auditor shall determine, as part of the assessment for establishing a new state high risk list, whether the previously identified agency or issue should appear on the new list.

(c) State agencies and statewide issues appearing on a state high risk list that is being succeeded by the establishment of a new state high risk list shall be carried forward to the new list unless the State Auditor determines, based on the assessment performed for establishing the new list, that particular agencies or issues appearing on the list satisfy the criteria set forth in California Code of Regulations, title 2, section 61012 for removal from the new list.

(d) The description of a state agency or statewide issue previously identified as high risk may be modified when the agency or issue is carried forward to a succeeding state high risk list if the State Auditor determines, based on the assessment performed for establishing the new list, that a modified description more accurately reflects the current assessment of risk.

(e) State agencies, including particular programs or mission areas within state agencies, and statewide issues may be added when establishing a new state high risk list provided the State Auditor determines that the state agencies and statewide issues satisfy the criteria set forth in California Code of Regulations, title 2, section 61013 for addition to the new list.