(a) When making an assessment to determine the state agencies and statewide issues that should appear on a new state high risk list, the State Auditor shall gather information to conduct the assessment. The State Auditor shall gather information from the State Auditor's past audit and investigative reports and may consult with state oversight agencies as provided in Government Code section 8546.5, subdivision (b). In addition, the State Auditor may obtain information from any other sources the State Auditor believes can provide information that would be helpful to the assessment, including information from the state agencies suspected of being high risk or potentially having some responsibility for a statewide issue suspected of being high risk. The State Auditor also shall accept information from government officials and members of the public.

(b) To obtain information for the purpose of making an assessment, the State Auditor may, among other efforts, request:

(c) While performing an assessment, the State Auditor shall maintain communication with the state agencies suspected of being high risk or potentially having some responsibility for a statewide issue suspected of being high risk to keep them apprised of the likely results of the assessment.

(d) Based on the information gathered as part of the high risk assessment performed for the establishment of a new state high risk list, the State Auditor shall preliminarily determine:

(e) Upon preliminarily determining the state agencies and statewide issues that should appear on a new state high risk list, the State Auditor shall issue a notice to the state agencies preliminarily determined to be high risk and to the state agencies considered by the State Auditor to be responsible state agencies for the statewide issues preliminarily determined to be high risk.

(f) Upon preliminarily determining the state agencies and statewide issues previously designated as being high risk that should not be included on the new state high risk list, the State Auditor shall issue a notice to the previously-designated state agencies and the responsible state agencies for the previously-designated statewide issues to advise them of the State Auditor's preliminary determination and invite them to raise any objection they may have to the State Auditor removing the agency or statewide issue from the state high risk list.

(g) After considering the responses provided by state agencies to the notices described in subdivisions (e)(1)(C) and (e)(2)(D) of this regulation, the State Auditor shall make a final determination of the state agencies and statewide issues that will be included in the new state high risk list and the state agencies that will be considered responsible state agencies for the statewide issues appearing on the list.