Can New Mexico's State Auditor examine agency computer systems during a special audit, and can a rule broaden that power?

Plain-English summary

New Mexico's Department of Finance and Administration asked whether the State Auditor's special-audit authority covered nonfinancial reviews of government information technology systems and whether an agency could expand that authority by rule.

Attorney General Raúl Torrez concluded that the State Auditor may examine an agency's computer systems only when the examination relates to the agency's financial affairs or transactions. Information that is not itself financial may still be reviewed when it bears on financial activity and generally accepted auditing standards require the examination. The opinion gave system integrity as an example of information that could matter to a financial audit.

The authority is limited. The State Auditor does not have broad power under NMSA 1978, Section 12-6-3(C) to check compliance with cybersecurity standards for purposes unrelated to financial affairs. That subsection covers state agencies; a footnote explained that audits of local public bodies arise under Section 12-6-3(B).

The AG also concluded that an administrative agency cannot enlarge a statutory limit through rulemaking. Any deference on an ambiguous provision would generally belong to an agency charged with administering that provision, and the opinion found it unlikely that the Cybersecurity Office would receive deference on its reading of the Audit Act.

What this means for you

State Auditor staff

The opinion permits review of information technology systems when the review is necessary to examine financial affairs or transactions under accepted auditing practices. It does not treat Section 12-6-3(C) as an independent grant of general cybersecurity oversight.

State agencies and government IT staff

An auditor may reach system information that bears directly on financial activity even when the information is not a conventional accounting record. The stated connection to financial affairs and auditing standards defines the scope of that access.

Cybersecurity Office officials

The Cybersecurity Office administers the Cybersecurity Act, but the opinion concluded that an agency rule could not expand the State Auditor's authority beyond the Audit Act. It also distinguished deference on the Cybersecurity Act from interpretation of a statute the office does not administer.

Local public bodies

The opinion's footnote placed local-public-body audit authority under Section 12-6-3(B), not the special-audit provision in Section 12-6-3(C).

Common questions

Q: Can the State Auditor inspect an agency's cybersecurity controls? A: Yes, when the controls or system integrity directly bear on the agency's financial affairs or transactions and the review is required by generally accepted auditing practices.

Q: Does the Audit Act authorize a general cybersecurity compliance review? A: No. The opinion said the State Auditor lacked broad power to examine agency systems for purposes unrelated to financial affairs or transactions.

Q: Can an agency regulation broaden the State Auditor's statutory power? A: No. An administrative agency cannot extend a statutory limit on its authority by rule.

Q: Did the AG find a conflict between the Audit Act and Cybersecurity Act? A: No definite conflict. The opinion said it was unclear what, if any, conflict existed between the cited provisions.

Background and statutory framework

The Audit Act, NMSA 1978, §§ 12-6-1 to -15, assigns annual and special-audit duties to the State Auditor. Section 12-6-3(C) allows the auditor to examine all or part of a state agency's financial affairs and transactions at any time. The opinion also cited 2.2.2.10(B)(2) NMAC for generally accepted accounting standards, including AICPA standards.

The Cybersecurity Act, NMSA 1978, §§ 9-27A-1 to -5, created the Cybersecurity Office and tasked it with developing and monitoring cybersecurity standards for executive cabinet agencies and attached entities. The opinion used Tri-State Generation & Transmission Ass’n, Inc. v. D’Antonio for statutory limits on agency power and Sw. Pub. Serv. Co. v. N.M. Pub. Regul. Comm’n for agency deference. It cited the federal district court decision in SEC v. SolarWinds Corp. as a comparable limit connecting cybersecurity controls to financial transactions.

Citations and references

Statutes and regulation:

• NMSA 1978, Section 12-6-3(C) (2011)
• NMSA 1978, Section 9-27A-3(B) (2023)
• NMSA 1978, §§ 12-6-1 to -15 (1969, as amended through 2019)
• NMSA 1978, §§ 9-27A-1 to -5 (2023)
• 2.2.2.10(B)(2) NMAC

Cases:

• SEC v. SolarWinds Corp., 741 F. Supp. 3d 37, 106–09 (S.D.N.Y. 2024)
• Tri-State Generation & Transmission Ass’n, Inc. v. D’Antonio, 2012-NMSC-039, ¶ 13
• Sw. Pub. Serv. Co. v. N.M. Pub. Regul. Comm’n, 2024-NMSC-012, ¶ 18

Prior opinion:

• N.M. Att’y Gen., No. 78-22 (Dec. 8, 1978)

Source

• Landing page: https://nmdoj.gov/publication/opinion/2026-09-opinion-scope-of-financial-affairs-or-transactions-under-nmsa-1978-section-12-6-3c/
• Original PDF: https://nmdoj.gov/wp-content/uploads/Attorney-General-Opinion-2026-09-Scope-of-financial-affairs-or-transactions-under-NMSA-1978-Section-12-6-3C.pdf

Original opinion text

September 3, 2026
OPINION
OF
RAÚL TORREZ
Attorney General

Opinion No. 2026-09

To:

Wayne Propst, Cabinet Secretary, Department of Finance and Administration

Re:

Attorney General Opinion – Scope of “financial affairs or transactions” under NMSA 1978, Section 12-6-3(C) Question

1. Whether, under NMSA 1978, Section 12-6-3(C) (2011), the term “financial affairs or
   transactions” contemplates nonfinancial examinations of state agencies and local public bodies’ information technology systems based on the AICPA’s five trusted services criteria?
2. Whether a state agency, by rule, can expand Section 12-6-3(C)’s limitation on special
   audits beyond “financial affairs or transactions,” in conflict with NMSA 1978, Section 927A-3(B) (2023)? Answer
3. The State Auditor may conduct a nonfinancial examination of a state agency or local public
   body’s information technology system if the examination is related to the financial affairs or transactions of the entity.
4. A state agency cannot expand a statutory limitation on its power, such as Section 12-63(C), by rule.

New Mexico Department of Justice
408 Galisteo Street | Santa Fe, NM 87501 | (505) 490-4060 | NMDOJ.GOV

Background
The State Auditor is a constitutional office with statutory duties to audit state agencies and local public bodies under the Audit Act, NMSA 1978, §§ 12-6-1 to -15 (1969, as amended through 2019). The State Auditor must audit the “financial affairs” of state agencies and local public bodies each year. Section 12-6-3(A), (B). Apart from the annual audit, the state auditor “may cause the financial affairs and transactions of an agency to be audited in whole or in part” at any time. Section 12-6-3(C) (emphasis added). The Cybersecurity Office is an administrative agency created by the Cybersecurity Act, NMSA 1978, §§ 9-27A-1 to -5 (2023), and administratively attached to the Department of Information Technology. Section 9-27A-3(A). The Office is tasked with developing and monitoring cybersecurity standards and infrastructure for “executive cabinet agencies and their administratively attached agencies, offices, boards and commissions.” Sections 9-27A-2(A), 3(B). Analysis First, you asked whether the State Auditor may conduct a “nonfinancial examination” of an agency or local public body’s information technology system under its Section 12-6-3(C) authority. The short answer is that if generally accepted accounting standards, like those issued by the AICPA, require the examination of nonfinancial information, like information technology systems, to audit the financial affairs and transactions of state agencies, then yes, a “nonfinancial examination” is permitted. 1 See 2.2.2.10(B)(2) NMAC (outlining generally accepted accounting standards, including AICPA standards). The State Auditor can audit the “financial affairs and transactions” of state agencies. Section 126-3(C). An audit is a “formal examination” to review an “organization’s accounting records, financial situation, or compliance with some other set of standards.” Black’s Law Dictionary (12th ed. 2024). We have previously recognized that the State Auditor is entitled to “all documents necessary to perform a thorough audit of every governmental entity, in accordance with generally accepted auditing standards.” N.M. Att’y Gen., No. 78-22 (Dec. 8, 1978) (opinion regarding municipal tax records). In other words, if the documents “bear[] upon the financial affairs” of an entity, even if they are not financial records per se, the State Auditor is permitted to examine them. Id. This logic naturally extends to information technology systems—if the systems, or their integrity, bear upon an agency’s financial affairs, and generally accepted auditing standards require their examination, the State Auditor may examine them. That said, the State Auditor does not have carte blanche to audit an agency’s information technology systems for purposes unrelated to the agency’s financial affairs or transactions. Section 12-6-3(C). At the federal level, courts have held that the authority to regulate financial affairs or 1

Section 12-6-3(C) permits only the audits of state agencies, not local public bodies. The State Auditor’s powers to audit local public bodies are defined at Section 12-6-3(B), and permit audits of the “financial affairs” of local public bodies according to procedures based on the body’s annual revenue. 2

transactions only extends to cybersecurity policies and dictates where those controls “directly relate[] to ensuring the integrity of the company’s financial transactions.” SEC v. SolarWinds Corp., 741 F. Supp. 3d 37, 106–09 (S.D.N.Y. 2024). The State Auditor does not enjoy a broad power to ensure agencies comply with cybersecurity standards. Instead, it enjoys a limited power to access and review information technology information as necessary for a financial audit and in compliance with generally accepted auditing standards. Second, a state agency cannot extend Section 12-6-3(C)’s limitation of the State Auditor’s power to “financial affairs and transactions” via rule. A state administrative agency cannot “go[] beyond the existing New Mexico statutes or case law it is charged with administering and claim[] the authority to modify this existing law or to create new law on its own.” Tri-State Generation & Transmission Ass’n, Inc. v. D’Antonio, 2012-NMSC-039, ¶ 13 (text only); id. (“Agencies are created by statute, and limited to the power and authority expressly granted or necessarily implied by those statutes.” (text only)). To the extent ambiguities in provisions of Section 12-6-3(C) or Section 9-27A-3(B) may exist or conflict, 2 only entities governed by those statutes are entitled to “some deference” in their interpretation of those ambiguities. Sw. Pub. Serv. Co. v. N.M. Pub. Regul. Comm’n, 2024-NMSC012, ¶ 18 (text only). For example, the Cybersecurity Office administers the Cybersecurity Act, so it might be entitled to some deference in its interpretation of Section 9-27A-3. On the other hand, it is unlikely that the Cybersecurity Office would be entitled to any deference in its construction of Section 12-6-3(C) because it does not administer the Audit Act. Conclusion It is the opinion of this office that Section 12-6-3(C) permits the examination of nonfinancial information, such as information technology systems, if it directly bears on the agency’s financial affairs and transactions and is required by generally accepted auditing practices. Additionally, administrative agencies cannot extend the scope of their authority by rule.

Please note that this opinion is a public document and is not protected by the attorney-client privilege. It will be published on our website and made available to the general public.

RAÚL TORREZ
ATTORNEY GENERAL
/s/ Daniel Ahrens
Daniel Ahrens
Assistant Solicitor General

2

It is unclear what, if any, conflict exists between Section 12-6-3(C) and Section 9-27A-3(B). 3