Kentucky audit finds state overcharged $33 million in taxes, details mismanagement of funds

LOUISVILLE, Ky. (WDRB) — Kentucky Auditor Allison Ball released a new report Monday detailing the mismanagement of funds across the state's executive branch.

The 120-page annual audit for Fiscal Year 2025 cites more than $1 billion in financial reporting errors, including a failure to report an additional $170 million more in state Medicaid expenditures.

"We saw some Kentuckians were having their taxes withdrawn twice," Ball said Tuesday.

The audit flagged $33 million in overcharged taxes, finding 4,000 taxpayers were charged twice. The state said it refunded $33.7 million for the error.

Ball said the Department of Revenue's new tax liability system "improperly identified $568 million in Kentuckian tax liability for collection that is not actually collectable understate law." It also found the Department of Revenue was "unable to explain how it calculates jeopardy tax assessments of approximately $48 million."

The audit revealed others issues with the Department of Revenue.

"We also found something that I think is pretty serious," Ball said. "They did a test hacking just to see 'How secure is this system?' We were told that the test hack got in in about 5 minutes."

"Of course, that puts a lot of things at risk, your personal identifying information, you could tamper with your taxes.

"I don't think the changes have been made. I think the Department of Revenue was a little dismissive about our concerns. They felt like there was a risk, but it was a risk they were comfortable with."

The audit also found the Cabinet for Health and Family Services didn't secure people's social security numbers and personal information.

For many of the problems, the administration said it has acknowledged, corrected and listed changes to prevent further mistakes. But one area in particular is still a fight: computer logins in the Kentucky Transportation Cabinet. Illegal driver's licenses being issued to immigrants, highlighted in a WDRB report last year, is also mentioned in the report. Ball said oversight failures in KYTC, "in part, led to the circumstances which resulted in the federal indictment of Transportation Cabinet temporary workers."

In February, federal prosecutors filed charges against five people accused of participating in a driver's license fraud and money laundering scheme tied to a Louisville-area driver's licensing branch — the same misconduct first raised publicly by a whistleblower.

Ball and KYTC don't agree on whether proper controls are in place to prevent password sharing.

The report also found major gaps in protecting Kentuckians' personal information from potential fraud. Ball's report found the state's Department of Revenue "failed to address security concerns" raised by the Commonwealth Office of Technology after a routine hacking test "showed the systems were vulnerable." The test found that the state's tax information system could have been hacked within minutes.

Ball said these findings reveal widespread carelessness and risk.

"This Statewide Single Audit presents over a billion dollars' worth of improvements the Commonwealth of Kentucky can make to ensure Kentuckians are protected, Kentucky law is respected, and Kentucky's finances are appropriately reported and cared for," Ball said in a news release. "It is vital that state agencies implement the improvements we have recommended in order to ensure Kentuckians are protected from waste, fraud and abuse."

Scottie Ellis with the governor's office released a statement that said, "Under Gov. Andy Beshear, Kentucky has experienced its three best years for economic development and the best year for new wages for our families. He secured the three largest budget surpluses in state history while also cutting income and property taxes. His management of the state has led to upgrades from all three bond rating agencies — a first in our history. While the auditor plays politics, the governor will keep working to move us forward, together."

The second part of the audit is expected to be released next week.

To look at the full report, click here.