What Washington auditors actually found
The Washington State Auditor's office published a finding in May 2026 with a practical warning for other states: the apportionment system supporting $30 billion in public education funding in the 2023–2025 biennium to roughly 300 school districts and charter and tribal schools statewide was described by a 2024 third-party review, cited in the audit, as at high risk of catastrophic failure. The seventeen-year-old software runs on aging infrastructure, has no documented recovery controls, and — the detail that should concern every state CIO in the country — depends on a vendor with only one trained staff member supporting its feeder systems, while OSPI lacks an IT technician with specific core-system knowledge.
OSPI had been warned about this trajectory internally since at least 2024 before auditors made it public.
How dependence accumulates
The Washington finding illustrates a transferable dependency risk. A state may operate systems that were procured a decade or two ago, handed to a vendor for implementation and support, and then left without a maintained knowledge-transfer plan. Potential contributors include staff turnover, missing knowledge transfer, absent or untested escrow rights, and a shrinking vendor support pool. Those are risks to investigate, not findings established for every state by this audit.
An agency can eventually become dependent on a support arrangement it cannot replace promptly, with recovery tasks that its own staff have not demonstrated. The outcome doesn't announce itself — it accumulates.
Ask questions uptime cannot answer
Routine service metrics can miss this dependency. A legacy system that processes transactions on time, passes routine reconciliation checks, and generates no helpdesk surge looks fine from the outside. A stronger annual IT assessment asks how many people — across both agency staff and vendor employees — could reconstruct the system from scratch if the current support team departed simultaneously. It also asks whether the vendor has formally documented recovery procedures that agency staff could actually execute.
It should examine the vendor's own operational continuity: whether that one trained employee has a designated backup, and whether the vendor organization itself is financially stable enough to survive the remaining years of the support contract. Washington OSPI received an external review in 2024, absorbed the warning, and obtained replacement funding beginning with the 2025–2027 budget; the interim control work still mattered while the replacement was being planned. The Legislature allocated sixteen million dollars across four fiscal years; a replacement system is targeted for the 2028-29 school year.
The system must continue supporting school funding during the replacement period; future allocations should not be assumed to equal the 2023–2025 amount.
Write continuity into the contract
The procurement decisions states make today influence the continuity risks their successors inherit. For critical systems, state buyers should consider vendor staffing minimums and succession documentation for critical-path support roles, source code escrow with usable retrieval and build rights where suitable, or equivalent data-export and transition protections for hosted services, and ongoing operational independence tests — periodic exercises in which agency staff demonstrate they can execute recovery procedures without vendor assistance. These provisions need to be matched to the service model and priced during acquisition.
An escrow deposit is of limited value if the state cannot build the code, obtain dependencies or lawfully run it; a hosted service may need a tested transition mechanism instead. Buyers should make any concession on continuity protections explicit. The difference between a legacy system and a ticking clock can be an untested dependency that never appeared in the acceptance criteria.
Protect the system during replacement
States that are now planning system replacements face a clear decision point: build operational independence requirements into replacement contracts, or repeat the cycle. OSPI's response in the audit targets a replacement for the 2028–2029 school year. OSPI's SASQUATCH procurement, issued November 10, 2025, scheduled proposals for February 13, 2026. The published procurement creates a concrete point at which to examine replacement requirements; its planned milestones are not proof that an award or deployment occurred. Before award, buyers have an opportunity to make continuity and transition terms part of competitive evaluation. What goes into a replacement contract can reduce the risk of recreating the same dependency.
The same holds true in every other state that is replacing a legacy system this year with another vendor-hosted, vendor-documented, vendor-sustained implementation. Neither the timing of the next audit nor the departure of the next key employee is predictable. Test continuity while the service is still running.
Test continuity before the next renewal
- Map the people dependency. Identify everyone who can change, restore and explain each critical component, including vendor staff. Record trained backups and the work that only one person can perform.
- Test recovery with a different operator. Give a qualified backup the runbook, approved credentials and test environment. Record missing steps, elapsed time and dependencies that required help.
- Review usable rights. Confirm access to data, configuration, documentation, build dependencies and transition assistance. Match escrow provisions to the actual product and licensing model.
- Fund interim controls. Do not wait for replacement go-live to document funding calculations, cross-train staff, test backups and review privileged accounts.
- Make independence an acceptance criterion. Require a successful handoff exercise and a maintained documentation set, with accountable owners on both sides of the contract.
What to measure
- Key-person exposure: critical tasks with only one trained operator.
- Recoverability: recovery exercises completed within the program's approved tolerance.
- Transition readiness: documentation, export and build tests completed, with unresolved dependencies costed.
Sources and further reading
- OSPI SASQUATCH RFP — procurement scope and scheduled dates
- Washington State Auditor performance audit — findings, 2024 review, funding and OSPI response
This is where Spartan X's engineering and program-execution disciplines belong together: making recovery, documentation and transition part of the deliverable, so a working system does not depend on one person's continued availability.
