Auditors didn't name a responsible party, and the state's CIO noted that accepting a certain degree of risk is just the way it goes in a budget-constrained organization like state government.