Recommendation: Malia M. Cohen, with moderate confidence. Cohen’s office has produced concrete progress in financial reporting and the state’s accounting-system transition. But a new State Auditor investigation found a serious breakdown in internal controls under her administration, and she did not complete several audit priorities she had promised as a candidate. Morgan makes the more aggressive case for continuous scrutiny and public transparency; his proposed system, however, has no published implementation cost, independent technical assessment or demonstrated path across the state’s different financial systems. The choice is between a mixed but documented operating record and a plausible reform agenda whose delivery remains unproven.
This analysis uses the sherafy.com Civic Outcomes Standard. Los Angeles County readers can return to the Los Angeles County Voter Guide 2026 for the complete ballot.
What the choice actually is
California voters choose a State Controller on November 3, 2026. The certified general-election candidates are incumbent Democrat Malia M. Cohen and Republican Herb W Morgan. They advanced from the June 2 top-two primary. The Secretary of State’s certified candidate announcement establishes the election and official roster; the official voter guide displays both candidates’ statements. Those paid statements are candidate advocacy, not fact-checked findings.
What the Controller can actually control
The Controller is California’s elected chief fiscal officer and accountant. The office records and reports state finances, issues payments, administers state payroll and unclaimed property, audits claims and disbursements, and conducts independent audits of agencies spending state funds. It also holds seats on dozens of boards and commissions, including CalPERS and CalSTRS. In fiscal year 2023–24, the Controller’s office says its Disbursements Bureau issued 64 million payments totaling $679 billion. Those figures describe the scale of payment processing, not a discretionary budget the Controller can redirect.
The legal role is substantial but bounded. Government Code section 12410 directs the Controller to superintend the state’s fiscal concerns and audit claims, and permits audits of disbursements for correctness, legality and legal authority. The state constitution provides that money may leave the Treasury only through an appropriation and a Controller’s warrant. These controls make the office an important check on payment legality and public accounting. They do not make the Controller the governor, budget-writer, program regulator or prosecutor. The office cannot unilaterally decide whether an appropriated program should exist, and an audit cannot substitute for the agencies that license providers, administer benefits or prosecute fraud.
This distinction matters in both candidates’ promises. Morgan’s voter-guide description of the job as approving expenditures and verifying “performance and proper use” points toward a real payment-review and audit role, but it can imply broader pre-approval authority than the law provides. A claim can be legally payable without the Controller independently confirming that every contracted service has been delivered. The office can audit and identify problems; agencies remain responsible for program operations, contracting and service verification.
Baseline: the record under Cohen and the realistic alternative
Cohen was elected in 2022 after serving on the State Board of Equalization and San Francisco’s Board of Supervisors. Her experience in elected fiscal bodies and state-level office is directly relevant to the position’s public accounting, payroll, audit and governance responsibilities. Morgan’s investment and financial-management background is also relevant: he founded an investment firm, managed portfolios, and served on the San Diego City Employees’ Retirement System board. His campaign biography reports those details; independent reporting corroborates his senior investment work and pension-board service. Neither background alone proves competence in California’s statewide accounting and payment systems.
The strongest measurable accomplishment during Cohen’s term is earlier state financial reporting. The Controller issued the 2024–25 Annual Comprehensive Financial Report on May 12, 2026, before the governor’s May Revision. The office says this was the fastest turnaround in years and the first time in eight years the report was available before major budget decisions. This progress matters because lawmakers, local governments, bond markets and residents need audited financial statements to assess the state’s actual financial position. It was also a joint effort: the State Auditor, Department of Finance and reporting departments contribute data and audit work.
The picture is not simply “fixed.” The independent State Auditor’s July 2026 report, based on a KPMG performance audit of the 2022–23 reporting process, said agencies deserved credit for recent progress but that more work remained. It identified shared causes including unclear roles between the Controller’s office and Department of Finance, inconsistent accounting guidance, a need for statewide training and late submissions from departments. The audit assessed a prior fiscal year and the broader reporting system; it is not a current financial-statement opinion or a finding that Cohen alone caused the historic delays.
The Controller also met the July 1, 2026, statutory transition of the state accounting book of record to FI$Cal, a major systems milestone. But the State Auditor’s 2025 FI$Cal report documented a demanding transition with 122 requirements still on the office’s list as of November 2025. The transition date is evidence of delivery, not proof that every downstream system, data interface or reporting problem is resolved.
There is also a follow-through gap. Cohen campaigned in 2022 on auditing homelessness spending and scrutinizing the DMV and Employment Development Department. Her office did not conduct a homelessness audit; she said funding was denied, while the office clarified its request did not specifically mention homelessness. She also said other agencies’ audits meant her office would not duplicate work on DMV and EDD. Those are relevant explanations, but the promised Controller-led reviews did not occur. A 2022 State Auditor report had already found serious hospice oversight problems, particularly in Los Angeles County, and assigned key responsibilities to Public Health, Health Care Services and the Attorney General’s office—not to the Controller. That history helps define the Controller’s supporting audit role without misattributing licensing and prosecution duties to it.
The newest audit: serious institutional failure, bounded attribution
On October 1, the California State Auditor published Investigative Report I2026-1, covering selected whistleblower investigations from July 2025 through June 2026. It found that Controller’s office personnel failed to collect more than $33,000 in two employee salary overpayments for more than a year. The office violated state law when a manager canceled a payroll deduction for one employee who had not agreed to repay; high-ranking officials pursued a poorly conceived government-claims route but never acted on it. The Auditor said the delay risked an improper gift of public funds. The report does not name the employees or executives and does not make a personal finding against Cohen.
The office said it was implementing the Auditor’s recommendations: one overpayment had been repaid, and deductions were beginning for the other. The Auditor disagreed with the office’s response that it had complied with law, explaining why the canceled payroll deduction and indefinite delay violated the collection requirement. In a separate case, the Auditor found two managers had worked from Idaho, Tennessee and Alabama while not residing in California, contrary to state law. The office said both managers had left and it was finalizing a policy with periodic monitoring. Those corrective steps are relevant, but were reported by the office and had not yet been independently verified in the report.
This is a serious test of Cohen’s claim that she strengthened internal controls. The same institution responsible for payroll and fiscal safeguards did not enforce repayment rules against its own employees, and its senior officials failed to carry out their alternative plan. That is direct evidence about the office’s management environment during her tenure. It would be inaccurate to say Cohen personally ordered the canceled deductions, participated in the plan, or was found to have violated law; the public report does not identify her as one of the officials. The accountability question is whether the documented failures and corrective response justify continuing with the incumbent who leads the agency.
The report’s scope also matters: the Auditor investigated 1,721 allegations, but says most lacked enough information to investigate and the public report presents selected cases as a deterrent, not a representative sample. The two SCO cases establish specific control and compliance failures, not a rate of misconduct across the office or a measure of all state payroll errors.
Morgan’s transparency and audit proposal
Morgan’s campaign proposes a public, near-real-time ledger using blockchain, along with risk-based audits of high-dollar programs, public exception registers and recovery tracking. The public-service rationale is strong: faster, more usable payment data could help journalists, researchers, legislators and the public spot patterns that arrive too late in conventional reports. The Controller’s independent audit authority can be used more assertively within the law, and continuous follow-up can be more useful than isolated reports that do not verify whether agencies corrected deficiencies.
California already has Open FI$Cal, a public spending portal, so the proposal’s added value needs to be specified. Its official FAQ says data are updated monthly, usually for transactions at least 60 days old; coverage depends on which entities use and review FI$Cal. The portal excludes, among other things, non-FI$Cal transactions, budget and contract information, confidential records and some non-expenditure transactions. It is unaudited and its totals should not be treated as final official expenditures. This creates a real transparency gap that Morgan could address, but the existing platform is a baseline he would need to integrate with, not a blank slate.
Blockchain can make entries difficult to alter after recording; it cannot establish that the original entry was true, that a vendor performed work, or that an expenditure was lawful. A credible implementation would need to identify the source systems and data standards, privacy and security rules, correction procedures, procurement path, independent testing, staffing, costs and how an exception would trigger a legally authorized audit or recovery. Morgan’s campaign site offers a prototype and broad goals, but the reviewed public materials do not provide a costed implementation plan or independently evaluated pilot. AI-based anomaly flags can prioritize human review; they do not themselves prove fraud.
Fiscal effects, distribution and opportunity cost
Neither candidate’s plan has a public, independently validated price tag that allows a fair comparison of incremental costs. California already funds the Controller’s office, the FI$Cal department, Open FI$Cal and statewide accounting modernization. A new ledger or continuous-audit program would need a budget and a clear account of whether it replaces, integrates with or duplicates existing systems. Conversely, stronger controls may prevent losses, speed recovery or reduce manual work, but no reviewed study estimates savings from Morgan’s specific platform or Cohen’s existing systems. No dollar return should be presented as a forecast.
The salary overpayments in the new audit are $33,000 in identified receivables, not a measure of the Controller’s office’s total payroll error rate or the fiscal benefit of either candidate’s platform. State Auditor investigations establish a concrete recovery and control problem, but not its prevalence.
Applying the ten Civic Outcomes lenses
| Lens | What the evidence means for this decision |
|---|---|
| Human welfare | Accurate, timely payments support public services and workers; stronger controls can protect public resources. The reviewed evidence does not show that either candidate’s program will improve health or service outcomes by a measurable amount. |
| Distribution and inequality | Transparent, searchable data can help residents and watchdogs scrutinize public spending. Usability, disability access, language access and public-record protections will determine who benefits; neither campaign has published a complete access plan. |
| Civil liberties and equal treatment | Public ledgers can expose vendor or beneficiary information. Privacy protections and fair correction procedures are essential; neither candidate has fully specified them. The telework finding concerns compliance with state residency rules, not political or personal surveillance. |
| Economic and material effects | Reliable payroll and disbursement systems matter to workers, vendors, local governments and beneficiaries. Faster reporting improves decisions, but major system changes can disrupt payments if migration and testing are weak. |
| Fiscal reality and opportunity cost | Current portal and system resources create a baseline. Neither proposal has a comparable cost estimate or verified savings estimate, so voters should not assume a blockchain investment pays for itself. |
| Institutional integrity and democratic accountability | The Controller is a check on payment legality and public accounting. The new audit found concrete noncompliance inside the office; the office’s stated corrective actions matter, but independent verification is pending. |
| Evidence of effectiveness | Earlier ACFR publication and the July 2026 accounting-system transition are tangible delivery evidence. Morgan’s platform is a campaign prototype, not an evaluated state deployment; neither candidate has demonstrated measurable impact of their full oversight agenda. |
| Implementation and administrative capacity | SCO performs high-volume payroll and payment duties; integrating data from diverse agency systems is difficult. Cohen has institutional experience and a delivery record, though with control failures. Morgan’s public-sector implementation experience is less documented, and his technical plan is incomplete. |
| Unintended consequences and behavioral response | Public anomaly lists could produce false accusations or encourage agencies and vendors to game indicators. Clear thresholds, human review, documented appeals and correction logs would be necessary. |
| Reversibility, resilience and future lock-in | Internal policies and audit priorities can be changed by future leadership. A statewide ledger procurement could create vendor dependence and expensive migration; staged pilots, open standards and exit rights would reduce that risk. |
The strongest case for and against each candidate
The strongest case for Cohen is that she has delivered identifiable improvements in an unusually complex office: the state’s accounting book of record moved to FI$Cal on the statutory date, and the latest ACFR arrived before the May Revision after years of delays. She has direct experience in the office and on fiscal governing bodies. A transition to a challenger with no documented experience running a California state agency could disrupt payroll, payment controls and systems work.
The strongest case against Cohen is that the office’s control problems are no longer abstract or inherited history. The newest Auditor report found unlawful noncollection and a year-long failure by senior officials to execute their chosen alternative. Cohen also did not deliver several audits she had promised. Her opponents can fairly ask why voters should reward modernization milestones while the office struggled to enforce basic rules in its own payroll operation.
The strongest case for Morgan is that his financial and investment background could bring a different operating mindset, and his stated emphasis on risk-based audits, corrective-action tracking and public data targets the weaknesses the record exposes. The public should not have to wait for a years-late statewide report to learn that payment controls failed. His private financial experience and pension-board service provide relevant management context, though not a proven substitute for public accounting leadership.
The strongest case against Morgan is that the key innovation he promises remains underspecified. California already has a public financial portal and is moving its accounting book of record to FI$Cal. Morgan has not shown how a blockchain would verify source data, fit into those systems, protect confidential information, correct bad entries or avoid duplicate expense. A wholesale technology change by an incoming Controller would carry operational risks. There is also no independent evidence that his proposed AI or ledger would reduce fraud or increase net recoveries.
Campaign claims audit
| Claim and claimant | Underlying evidence | Finding | Limit |
|---|---|---|---|
| Cohen says she improved transparency and financial reporting. | SCO published the FY 2024–25 ACFR May 12, 2026, before the May Revision; the independent July 2026 performance audit credited recent progress while identifying further shared-system reforms. | Supported, with qualification. Reporting improved materially; the statewide high-risk issue was not declared solved. | The ACFR is a joint product and report timing is not proof every accounting control works. |
| Cohen says internal controls improved. | State Auditor I2026-1 found specific failures in SCO’s recovery of two employee overpayments and out-of-state telework monitoring. | Partly supported / materially challenged. The office reports corrective steps, but the new findings contradict any broad claim that internal controls were adequate. | The audit does not identify Cohen personally as directing the conduct and is not a representative sample of all controls. |
| Morgan says the Controller can pre-audit claims and use payment oversight to prevent waste. | Government Code §12410; SCO’s description of its audit and disbursement duties. | Partly supported. The Controller audits claims and can examine disbursements; the office is not a universal program-performance certifier or regulator. | Legal claim review does not verify every service outcome before payment. |
| Morgan says a blockchain/AI system can provide real-time transparency and expose waste. | Campaign platform and prototype; Open FI$Cal’s documented coverage and update limits. | Plausible objective, unproven mechanism. A better interface and expanded data could help public oversight. | No public cost, technical assessment, independent pilot or demonstrated fraud-reduction effect was located. |
| Morgan’s claim that California’s Controller can audit Medi-Cal claims touching the Treasury. | The 2022 State Auditor hospice report assigns primary Medi-Cal fraud detection and investigation to DHCS and DOJ; the Controller has separate authority to audit claims and state disbursements. | Needs scope limits. The Controller can contribute fiscal audits; licensing, claims administration and prosecution sit primarily with other agencies. | The Controller’s role depends on the specific payment, legal authority and audit scope; it is not the lead hospice regulator. |
Funding and interested parties
The comparable CAL-ACCESS candidate-committee summaries for January 1 through September 19, filed September 24, show Cohen’s committee with $795,354 in contributions, $387,584 in expenditures and $1,623,101 in ending cash. Morgan’s committee reported $545,301, $415,067 and $139,486, respectively. These are candidate-committee figures for the same reporting period, not a complete tally of independent expenditures, outside support or all election-cycle activity. A filing-summary source links the underlying CAL-ACCESS records; direct CAL-ACCESS pages were not independently reconciled here.
Cohen’s official voter-guide statement lists labor organizations among her supporters. That alignment is relevant to a fiscal oversight office that administers public payroll and interacts with pension boards, but support alone is not evidence that a donor influenced an audit, payroll decision or investment vote. The reviewed record did not establish such a connection. Morgan’s campaign centers his investment-sector experience; no specific financial conflict affecting the office was established in the sources reviewed. These notes are context, not a finding of improper influence.
What remains unknown
The Auditor’s new report does not identify the high-ranking SCO executives by name, so the public record reviewed here cannot establish Cohen’s personal knowledge or involvement. The office’s corrective measures on collections and telework need follow-up verification. The review also did not reconcile every prior audit promise with a complete inventory of SCO audit reports, nor did it independently measure the overall effectiveness of the office’s controls.
Morgan has not published a full system architecture, procurement or staffing plan, implementation schedule, privacy rules, independent security assessment, estimated lifecycle cost or measured pilot results. His campaign claims a prototype exists, but a prototype does not establish readiness for California’s state accounting operations. Neither candidate has a comparable estimate of fraud prevented, money recovered, audit outcomes improved or taxpayer savings attributable to their approach.
What would change this analysis?
Independent evidence that SCO has recovered both overpayments, implemented the Auditor’s recommendations and verified compliance across staff would strengthen Cohen’s case. Evidence that the same senior control failures continued, that recommendations were not implemented, or that further audits found repeated unlawful payment or payroll practices would weaken it substantially.
A costed, independently reviewed Morgan implementation plan with open standards, security and privacy protections, correction procedures, public-sector accounting expertise, a successful pilot and a clear relationship to FI$Cal/Open FI$Cal would strengthen his case. Demonstrated disruption, high lifecycle costs, unverifiable data or no improvement over existing transparency tools would weaken it. Evidence that either candidate’s audit approach materially improved service outcomes or verified recoveries would be more persuasive than platform claims alone.
sherafy.com recommendation: Malia M. Cohen — moderate confidence
The recommendation rests on role-specific performance evidence rather than party or incumbency. Cohen’s administration has concrete operating achievements: the FY 2024–25 ACFR was released before the May Revision, and the statutory book-of-record transition to FI$Cal occurred on schedule. These are relevant deliverables in an office responsible for accounting, disbursement and reporting. Recent progress involved multiple agencies, so the record supports credit for leadership and execution, not sole attribution.
The strongest contrary evidence is serious: the State Auditor found that SCO failed to collect more than $33,000 in employee overpayments for over a year, including a legally required deduction canceled by a manager, and identified two managers who violated state telework rules. It is fair to hold the Controller accountable for the office’s controls during her term. It is not fair to attribute the anonymous officials’ conduct personally to Cohen without evidence. The office’s corrective response is positive but remains an agency-reported action, and the office disputed the Auditor’s legal conclusion.
Morgan’s case for more proactive auditing and accessible records addresses real weaknesses, and his financial background is relevant. But the most distinctive proposal—a blockchain and AI platform—has no disclosed costed plan, independent test or evidence that it improves on California’s existing portal and system modernization. For a high-volume office where a failed transition could affect payment, payroll and reporting, demonstrated delivery capability carries meaningful weight. The evidence currently favors keeping the official who has overseen measurable modernization while demanding verified correction of the audit failures.
Confidence is moderate because the fresh audit materially weakens Cohen’s management record and Morgan’s proposed alternative is not yet testable as an implementation plan. This conclusion would change if the Controller’s office failed to complete verified corrective action or if Morgan produced a credible, independently reviewed plan showing how his approach would improve controls without destabilizing core systems. This is a judgment about the candidates and available evidence, not a forecast of election results.
Evidence Ledger
| Material question | Finding | Evidence type and source | Confidence | Limit |
|---|---|---|---|---|
| Who is on the November ballot? | Malia M. Cohen and Herb W Morgan; November 3, 2026 general election. | Official certified candidate announcement and voter guide | High | Recheck for any later official correction before release. |
| What can the Controller do? | Audit claims and disbursements, oversee fiscal reporting, administer payroll and unclaimed property, and issue warrants under constitutional appropriation limits. | Statute, constitution and SCO functions page | High | Not a general regulator, budget-maker or service-performance guarantor. |
| Did state financial reporting improve? | 2024–25 ACFR appeared May 12 before the May Revision; KPMG/State Auditor credits progress but says more work remains. | Descriptive official release and independent performance audit | High for dates; moderate for attribution | Progress is shared across the state reporting system. |
| Did the Controller’s office have a control failure? | State Auditor found a legal violation in recovery of one receivable, a year-long delay involving two receivables over $33,000, and out-of-state telework violations by two managers. | Independent investigative findings | High for the specific cases | Selected cases; no personal finding against Cohen or office-wide prevalence estimate. |
| Would Morgan’s platform improve outcomes? | It could make more timely data accessible, but system effects, cost and fraud reduction are unproven. | Candidate advocacy and official Open FI$Cal documentation | Low/indeterminate | No independent pilot or lifecycle plan located. |
| Which candidate should voters choose? | Cohen, moderate confidence, based on delivery record weighed against a serious recent controls failure and Morgan’s untested implementation plan. | Editorial judgment | Moderate | Sensitive to verified remediation and a costed challenger plan. |
References and Further Reading
- Secretary of State: certified November 3, 2026 candidate list — verifies the certified general-election roster and date.
- California Secretary of State: Controller candidate statements — reproduces paid statements; the state says candidates supply them and the office does not check their accuracy.
- State Controller’s Office: functions — official description of audit, payment, payroll, unclaimed-property and board responsibilities; it is an agency description, not an independent evaluation.
- California Government Code §12410 and California Constitution, Article XVI, §7 — legal authority for claim review, disbursement audits and warrant requirements.
- California State Auditor, Report I2026-1 — read the SCO overpayment and telework cases, findings, recommendations and agency responses. It reports selected whistleblower cases, not a random sample.
- California State Auditor, Report 2025-602 — summary and full KPMG performance audit of late state financial reporting; it reviews a prior reporting period and shared system causes.
- SCO, FY 2024–25 ACFR and release announcement — date, report context and Controller’s explanation; the release is from the office evaluated.
- California State Auditor, FI$Cal Report 2025-039 and FI$Cal transition timeline — statutory transition and pre-transition requirements.
- Open FI$Cal FAQ — coverage, monthly update timing, omissions and data-quality caveats for the existing public portal.
- California State Auditor, Hospice Licensure and Oversight, Report 2021-123 — reviewed findings on California hospice oversight and division of agency duties; evidence predates Cohen’s term and is not a Controller-office audit.
- Morgan campaign platform — source for the ledger, audit and transparency promises; campaign advocacy, not an independent technical assessment.
- Los Angeles Times, Controller race guide — contextual reporting on prior audit promises and candidate backgrounds; used as secondary evidence, not as a substitute for agency records.
- CAL-ACCESS candidate-committee summary — comparable filings for January 1–September 19, 2026, reported September 24; the summary links official records but was not fully reconciled against every filing or outside spender.
Editorial currency and research limits
Research currency: October 10, 2026. Candidate roster checked against the Secretary of State’s certified November list and official general-election guide. Campaign finance uses the January 1–September 19 filing period, reported September 24. The latest independent office-control evidence reviewed is State Auditor I2026-1, published October 1. Before release, refresh candidate roster and finance, verify remediation of I2026-1 recommendations, and confirm FI$Cal/Open FI$Cal system status. This is a source-based editorial comparison, not an independent technical audit, legal opinion or forecast of fraud recoveries.
Return to the Los Angeles County Voter Guide 2026.
