By Shaina Cole | Contributing Writer, Rocky Mountain Voice
By Sept. 30, Colorado’s Department of Personnel and Administration is due to produce its annual tally of contracts covered by the state Procurement Code — the number awarded, the initial dollar amounts recorded, and the share that went to service-disabled veteran-owned small businesses.
The last three tallies were wrong by hundreds of millions to billions of dollars, the state auditor has found. And this year, the department has said it does not plan to send the report to lawmakers at all.
The Office of the State Auditor laid it out in Report 2556P, a performance audit of the state’s contracting goal for service-disabled veteran-owned small businesses, released in May.
The audit’s stated purpose was to figure out why Colorado keeps missing that goal. What auditors found along the way was that the extraction and calculations underlying the reports did not hold up.
One report told the General Assembly that two entire state departments had awarded contracts worth zero dollars.
What the report told lawmakers
The Fiscal Year 2024 report overstated the total dollar amount of state contracts by $2.1 billion. It overstated the number of contracts by 3,143.
Auditors traced the cause to a filtering step that failed. Staff, the audit says, “inadvertently included, rather than excluded, expenditure codes that DPA’s procedures cited should be used to filter contracts out of the data.”
The errors run in different directions in different years, and each is its own mistake rather than part of a running total.
The same year, the report said the Department of Law awarded one contract worth $55,845. The actual number was 175 contracts worth about $5.8 million.
Fiscal Year 2023 was off by $590 million, mostly because DPA counted about $380 million in medical services that are not subject to the Procurement Code and should never have been in the tally.
Then came Fiscal Year 2025.
This time DPA went the other direction on dollar value, understating the total by $908 million, mostly because of computation errors.
The 2025 report also stated that the Department of Health Care Policy and Financing and the Department of Law had each awarded contracts totaling zero dollars. HCPF actually awarded 257 contracts worth about $336 million that year, according to the audit, and Law awarded 197 contracts worth about $7.7 million.
HCPF is among the state’s largest contracting agencies. The $336 million it actually awarded in Fiscal Year 2025 was one of the higher agency totals that year. The report put it at nothing.
How the errors got through
The audit says why the errors survived to print.
Statewide Equity Office staff, who inherited the report in mid-2024, “appear to lack a sufficient understanding or historical knowledge of how to review the data for accuracy.” Those staff did not flag that a department’s total contract awards should not come to $0, or that a statewide contract total should not swing by more than $1 billion from one year to the next.
DPA moved the report in May 2024 out of its State Purchasing and Contracts Office, which had produced it since 2015, and into the Statewide Equity Office inside its human resources division.
The Sept. 30 deadline is set in statute. DPA has missed it the last two years.
The Fiscal Year 2024 report went to the legislature 51 days late, and the Fiscal Year 2025 report 24 days late, according to the audit. DPA told auditors the Fiscal Year 2025 report was late because of a miscommunication over who was supposed to send it.
The context disappeared as the errors continued
There is a second thing the audit documents, and it runs alongside the first.
At the same time the reports continued producing errors, the explanation attached to the figures disappeared.
Reports for Fiscal Years 2024 and 2025 “did not include any information to explain the data being reported or otherwise provide context for what the data indicated regarding progress, or lack of progress, towards the goal.”
The audit adds that this “information was regularly provided in prior year reports.” Every report from 2015 through 2023 had explained what businesses count toward the goal, how many were operating in Colorado, and what DPA had done that year to move the number.
DPA’s own written procedure says the report should explain the data and describe the steps the state has taken. The 2024 and 2025 reports did neither.
The goal nobody checked
The report exists in the first place because of a goal set in 2014. House Bill 14-1224 set a goal that at least 3 percent of contracts subject to the Procurement Code, by dollar value, go to service-disabled veteran-owned small businesses.
The state has never come close.
Over 11 years, DPA’s reported share has ranged from a low of 0.07 percent to a high of 0.43 percent. In Fiscal Year 2025, DPA reported $6.97 million awarded to these businesses. Reaching the 3 percent goal would have taken $110.5 million.
The auditor’s finding on the goal itself is that no one ever checked whether it could be met.
The 3 percent figure “was set at 3 percent based on the federal government’s goal at the time,” the audit says, with no analysis of whether Colorado had the service-disabled veteran-owned small businesses to fill it.
Auditors ran that math themselves.
Spread across all of the roughly 700 such businesses in Colorado, the $110.5 million goal would have meant a state contract of $158,000 or more for each. Spread only across the 200 registered on the state’s main bidding platform, it would have meant $552,000 or more apiece. The average state contract that year ran about $221,000.
The agencies that do the contracting did not uniformly use the preference during the period auditors examined. Of the 36 agency procurement officials who responded to the auditors’ survey, 12 said their agency did not provide a preference between Fiscal Years 2023 and 2025.
What happens to the report now
Legislative Council staff pointed to a separate state law under which periodic executive-agency reporting requirements to the General Assembly expire after three years.
After auditors raised that issue with DPA, the department said that going forward it would stop sending the report to the legislative committees and would send it only to the Department of Military and Veterans Affairs and the Board of Veterans Affairs.
Auditors said lawmakers should clarify whether the committees are still meant to receive it.
DPA agreed with all four of the auditor’s recommendations. It told auditors it would add an internal review layer to catch data errors, fix its filtering, and restore the context that dropped out of the last two reports.
None of it takes effect until 2027. The report due this Sept. 30 will be produced the same way as the three the auditor found wrong.