Kirkwood Institute, Inc. v. Iowa Auditor of State Rob Sand, John McCormally, and Office of the Auditor of State

IN THE SUPREME COURT OF IOWA

No. 23–0201

Submitted December 14, 2023—Filed April 26, 2024

KIRKWOOD INSTITUTE INC.,

Appellant,

vs.

IOWA AUDITOR OF STATE ROB SAND, JOHN MCCORMALLY, and OFFICE OF
THE AUDITOR OF STATE,

Appellees.

Appeal from the Iowa District Court for Polk County, Robert Hanson,

Judge.

An entity that requested public records from the Office of the Auditor of

State appeals the district court’s grant of summary judgment dismissing its

claims alleging statutory violations. AFFIRMED IN PART, REVERSED IN PART,

AND REMANDED.

McDermott, J., delivered the opinion of the court, in which all justices

joined.
Alan R. Ostergren (argued), Des Moines, for appellant.

Brenna Bird, Attorney General; Tessa M. Register, Assistant Solicitor

General (until withdrawal); and David M. Ranscht (argued), Assistant Attorney

General for appellees.
 2

MCDERMOTT, Justice.
The Kirkwood Institute sent an open records request to the Office of the

State Auditor seeking emails between the Auditor’s office and two investigative

reporters. The Auditor’s office in its response withheld ten email chains as ex-

empt, citing Iowa Code § 11.42 (2021), protecting “information received during

the course of any audit or examination,” and § 22.7(18), protecting communica-

tions made by a person outside government where disclosure might reasonably

risk discouraging similar communications. Kirkwood sued, arguing that the Au-

ditor’s office failed to meet its burden to show that an exception applied to the

ten withheld email chains and, further, that the Auditor’s office failed to disclose

an eleventh responsive email chain that had been quoted extensively in one re-

porter’s blog.

Several months into the lawsuit, after Kirkwood had served discovery re-

quests, the Auditor’s office provided the eleventh email chain quoted in the blog

post. Both parties moved for summary judgment. The Auditor’s office provided

the other ten email chains for the district court to review in camera (i.e., privately

in chambers) to determine whether the asserted exceptions applied. The district

court entered summary judgment in favor of the Auditor’s office, holding that the
ten email chains were exempt from production and that no violation occurred

with the late turnover of the eleventh email chain. Kirkwood appeals.

I.

In June 2021, the Auditor’s office issued a report of a special investigation

into Governor Kim Reynolds’s role in a public awareness campaign to address

COVID-19 called “Step Up, Stop the Spread.” Kirkwood sought information about

the special investigation and, on June 16, submitted an open records request to

the Auditor’s office under Iowa Code chapter 22. The time frame for the records
 3

spanned January 2, 2019 (corresponding with Auditor of State Rob Sand’s first

day in office) to the present. Kirkwood requested the following:

• All emails sent to, sent from, or otherwise exchanged between
any employee of the Auditor of State’s office, including the Audi-
tor, and the email address “desmoinesdem@bleedingheart-
land.com”.

• All emails sent to, sent from, or otherwise exchanged between
any employee of the Auditor of State’s office, including the Audi-
tor, that contain the phrase “desmoinesdem@bleedingheart-
land.com”.

• All emails and text messages sent to, sent from, or otherwise ex-
changed between any employee of the Auditor of State’s office,
including the Auditor, that contain the word “Belin”.

• All emails sent to, sent from, or otherwise exchanged between
any employee of the Auditor of State’s office, including the Audi-
tor, and the email address “rjfoley@ap.org”.

• All emails sent to, sent from, or otherwise exchanged between
any employee of the Auditor of State’s office, including the Audi-
tor, that contain the phrase “rjfoley@ap.org”.

• All emails and text messages sent to, sent from, or otherwise ex-
changed between any employee of the Auditor of State’s office,
including the Auditor, that contain the word “Foley”.

The requests involving the “@bleedingheartland.com” email address and “Belin”

are in reference to reporter Laura Belin, who maintains a blog called Bleeding
Heartland. The requests involving the “@ap.org” email address and “Foley” are in

reference to a reporter named Ryan Foley with the Associated Press.

Information technology staff within the Auditor’s office promptly con-

ducted electronic searches to gather documents responding to Kirkwood’s re-

quests. The Auditor’s chief of staff, John McCormally, reviewed the documents

containing the requested search terms and withheld production of any records

he decided were covered by a statutory exception.
 4

On July 6, the Auditor’s office provided Kirkwood, at no cost, the first of

two tranches of responsive records. McCormally informed Kirkwood in an ac-

companying letter about difficulties in retrieving records that predated May 30,

2019, because of a change in email systems around that time. The Auditor’s

office offered to retrieve and produce these earlier records upon payment of a fee,

which Kirkwood agreed to pay.

On August 23, the Auditor’s office provided the emails from January

through May 2019. In an accompanying letter, McCormally stated that nine

email threads were withheld as confidential under Iowa Code § 11.42(1) as

“information received during the course of any audit or examination, including

allegations of misconduct or noncompliance,” and a tenth email thread was

withheld as confidential under § 22.7(18) as communications not required by

law from people outside government whose disclosure would discourage similar

communications in the future.

Kirkwood was aware of an eleventh email not provided by the Auditor’s

office that, it argued, did not fall within the exceptions in § 11.42(1) or § 22.7(18).

This email, which McCormally reportedly sent to Belin on June 4, 2021, was

quoted in a Bleeding Heartland blog post by Belin shortly after. The email was
reported to include statements from McCormally that defended the Auditor’s of-

fice’s report criticizing the Governor’s “Step Up, Stop the Spread” campaign. The

blog post included a lead-in sentence by Belin stating, “McCormally offered ad-

ditional thoughts via email on June 4,” followed by this excerpt from McCor-

mally’s email:

“But Ostergren noted that ‘Section 29C.6(10) says she can
spend state resources to deal with the emergency,’ which is what
happened here.”

It’s not what happened here. The full text [of] 29C.6(10) says:
 5

Utilize all available resources of the state government as rea-
sonably necessary to cope with the disaster emergency.

That doesn’t mean the Governor can do whatever she wants.
29C must be narrowly construed. The statute does not give her ab-
solute power. She can redirect money, she can suspend laws, but
she still has to follow certain procedures when she does so. She has
to say what she is doing and why she is doing it in a disaster proc-
lamation. She didn’t do that.

Reading 29C.6(10) the way you suggest would nullify the rest
of the 29C– if she can do whatever she chooses with any state “re-
source” when she declares an emergency, the rest of the statute is
superfluous. It might as well say “When she declares an emergency,
the Governor is the only law.” That would amount to unconstitu-
tional delegation of legislative power to the executive. Even in an
emergency, she is still subject to the law.

You may think a paid ad featuring her face was a reasonable
thing for her to spend money on, or that this is too technical. Those
are reasonable positions. However, there are rules for spending tax-
payer money. And she didn’t follow them. Making sure Is are dotted
and Ts are crossed when it comes to the spending of taxpayer money
is the entire job of the state Auditor.

Laura Belin, A Failure to Communicate, Bleeding Heartland (June 3, 2021),

https://www.bleedingheartland.com/2021/06/03/a-failure-to-communicate

[https://perma.cc/VH2R-MGGY].

On October 3, Kirkwood sued the Office of the Auditor of State, Auditor

Sand, and McCormally (collectively, the “Auditor’s office”), alleging violations of
Iowa’s open records laws. Kirkwood specifically alleged that the Auditor’s office

failed to produce the June 4 email chain between McCormally and Belin without

a legal basis. The petition included a block quote of McCormally’s email from the

blog post. The Auditor’s office denied any allegations of wrongdoing in its answer.

On January 18, 2022, the Auditor’s office, in response to a request for

production of documents in the lawsuit, provided Kirkwood with the

McCormally-Belin email chain for the first time. The email showed that
McCormally had used a private email account to send it. According to an affidavit
 6

that McCormally submitted with the summary judgment motion, this fact

explained why the email did not appear in the earlier search conducted on the

Auditor’s office’s email system. The Auditor’s office also provided two other

emails exchanged between McCormally and Belin from McCormally’s personal

email account of a nonsubstantive nature that hadn’t previously been turned

over.

In its discovery responses, the Auditor’s office again did not disclose the

ten emails discussed earlier. For each email, it provided a summary that in-

cluded the following information:

1. The date of the first and last email in the chain.

2. The personnel of the Auditor of State’s office included in the email
or email chain.

3. The subject matter of the chain.

4. The specific basis, described in narrative form with citation to
legal authority, of the grounds to withhold the email or email
chain.

5. A description of any inquiry made to any nongovernmental em-
ployee who sent or received information in the email or email
chain as to whether such person would consent to the disclosure
of the email or email chain.

6. Whether the email or email chain relates to an audit or examina-
tion conducted by the Office of the Auditor of State and, if so, the
date the audit or examination was or will be completed.

Both parties moved for summary judgment. Kirkwood argued that the

Auditor’s office failed to show that it had properly withheld the email chains and

thus Kirkwood was entitled to judgment in its favor. The Auditor’s office argued

that the ten withheld emails were confidential and not discoverable under Iowa

Code § 11.42 and § 22.7(18), and thus Kirkwood’s claims should be dismissed.

The Auditor’s office provided all ten email chains to the district court for an in
camera review as it considered the motions.
 7

The district court first considered the withheld email chain where the

Auditor’s office claimed protection under both § 11.42 and § 22.7(18). After

reciting § 22.7(18), the district court stated its conclusion that “[h]aving reviewed

the email in-camera, the Court concludes it is information which must be kept

confidential within the meaning of section 22.7(18) and, therefore, was properly

withheld.” Turning to the nine withheld emails where the Auditor’s office claimed

§ 11.42 applied, the court recited § 11.42 and again stated its conclusion: “After

reviewing the emails in question, the Court finds the emails fall under the

protection of section 11.42 as having been received during the course of an audit

or examination” and thus “were properly maintained as confidential and

withheld.” The district court granted summary judgment in favor of the Auditor’s

office.

Kirkwood filed a motion to reconsider the ruling. It first requested that the

district court address the McCormally-Belin email that the Auditor’s office failed

to provide in response to the open records request until the discovery phase of

the lawsuit. Kirkwood also argued that the conclusory statements in the court’s

order did not explain how or why § 11.42 and § 22.7(18) actually applied to any

of the ten withheld emails.
The district court’s ruling on the motion to reconsider addressed both

points. Regarding the eleventh email, the court stated:

[Kirkwood] first requests the Court issue a ruling which holds
the timing of [the Auditor’s office]’s release of the eleventh email
chain does not render [Kirkwood]’s claim moot. [The Auditor’s office]
established the email chain in question was initially not discovered
due to its location in personal email correspondence. The Court
finds no evidence establishing the delay was purposeful or the result
of any improper motive on the part of [the Auditor’s office], but was
simply the result of the late discovery of the information.

As to Kirkwood’s request for more details on the court’s finding that § 22.7(18)
 8

and § 11.42 applied, the court stated:

[Kirkwood] additionally moves the Court to provide details as to why
the material, reviewed in-camera, was determined to be covered by
statutory privilege. Disclosure of details of the information, includ-
ing the basis on which the Court’s ruling was reached, beyond what
was already revealed/explained by [the Auditor’s office] in their dis-
covery responses and in paragraph 17 of defendant McCormally’s
affidavit in support of defendant’s motion for summary judgment . . .
would necessarily involve discussion of confidential and privileged
information. This would frustrate the purpose of the court’s in-cam-
era review. Consequently, the Court declines to go into the details of
the information revealed by its in-camera review other than to state
the Court’s ruling is fully supported by the facts and applicable Iowa
law.

The court denied the motion to reconsider. Kirkwood appeals.

II.

Kirkwood contends that the district court erred in several ways. First,

Kirkwood argues it established that the Auditor’s office violated chapter 22 by

failing to timely produce the McCormally-Belin email chain. Second, Kirkwood

argues that the district court erred in applying § 11.42 and holding that the nine

email threads between the Auditor’s office and reporters constitute “information

received during the course of any audit or examination” under the statute. And

third, Kirkwood argues that the district court erred in applying § 22.7(18) to the

tenth email chain.

A.

Iowa’s open records law, codified at Iowa Code chapter 22, is premised on

the notion that “free and open examination of public records is generally in the

public interest even though such examination may cause inconvenience or em-

barrassment to public officials or others.” Iowa Code § 22.8(3). “Every person

shall have the right to examine and copy a public record.” Id. § 22.2(1). A “public

record” is defined to “include[] all records, documents, tape, or other information,
stored or preserved in any medium, of or belonging to this state.” Id. § 22.1(3)(a).
 9

The statute contains a long list of exceptions protecting specific categories of

records from disclosure. See id. § 22.7.

Section 22.10(1) authorizes an aggrieved person to pursue judicial en-

forcement of the statute’s requirements through an action against the public

records’ lawful custodian. The statute describes the judicial enforcement process

as follows:

Once a party seeking judicial enforcement of this chapter demon-
strates to the court that the defendant is subject to the requirements
of this chapter, that the records in question are government records,
and that the defendant refused to make those government records
available for examination and copying by the plaintiff, the burden of
going forward shall be on the defendant to demonstrate compliance
with the requirements of this chapter.

Id. § 22.10(2).

Kirkwood argues that the district court erred in concluding that no open

records violation occurred because the failure to produce the McCormally-Belin

email was not “purposeful” or the “result of any improper motive.” Kirkwood ar-

gues that although a knowing violation results in a greater penalty, monetary

penalties are nonetheless required for unintentional violations as well and that

the Auditor’s office never claimed below that its late production was uninten-

tional. The Auditor’s office, for its part, argues that producing the McCormally-

Belin email mooted any cause of action concerning it and that Kirkwood is at-

tempting to shift its claim from alleging insufficiency to alleging delay. The par-

ties agree that we review the district court’s summary judgment ruling for cor-

rection of errors at law. Rieder v. Segal, 959 N.W.2d 423, 425 (Iowa 2021).

Our recent opinion in Belin v. Reynolds—issued after the district court’s

ruling in this case—guides several of the open records questions presented here.

989 N.W.2d 166, 169 (Iowa 2023). In that case, Laura Belin and several other
reporters and news organizations sued the Governor’s office, Governor Kim
 10

Reynolds, and members of the Governor’s staff for failing to timely produce rec-

ords in response to multiple open records requests. Id. at 169–70. The defend-

ants moved to dismiss the case, asserting (among other defenses) that the plain-

tiffs’ claims were moot because the defendants had turned over the requested

documents shortly after the lawsuit was filed. Id. at 170.

We said that “where (as here) it is clear that the plaintiffs have sought

government records from defendants who are subject to the requirements of

chapter 22, the only question is whether the defendants ‘refused to make those

government records available.’ ” Id. at 176–77 (quoting Iowa Code § 22.10(2)). We

interpreted the statutory language to state “that a defendant may ‘refuse’ either

by (1) stating that it won’t produce records, or (2) showing that it won’t produce

records.” Id. at 174. A refusal of the second type, we observed, could be demon-

strated “through an unreasonable delay in producing records.” Id. On this point,

we recited our earlier observation that,

[a]lthough section 22.10(2) speaks in terms of a refusal rather than
a delay in production, we think a refusal to produce encompasses
the situation where, as here, a substantial amount of time has
elapsed since the records were requested and the records have not
been produced at the time the requesting party files suit under the
Act.

Id. (alteration in original) (quoting Horsfield Materials, Inc. v. City of Dyersville,

834 N.W.2d 444, 463 n.6 (Iowa 2013)). Although “[g]ood-faith, reasonable delay”

in producing a public record is not a violation, Iowa Code § 22.8(4), “[e]xtensive

delay may—on its own—establish an implicit refusal,” Belin, 989 N.W.2d at 175.

We listed additional facts that bear on whether a defendant’s conduct constitutes

a refusal to produce records, including:

(1) how promptly the defendant acknowledged the plaintiff’s re-
quests and follow-up inquiries, (2) whether the defendant assured
the plaintiff of the defendant’s intent to provide the requested rec-
ords, (3) whether the defendant explained why requested records
 11

weren’t immediately available (e.g., what searches needed to be per-
formed or what other obstacles needed to be overcome), (4) whether
the defendant produced records as they became available (some-
times called “rolling production”), (5) whether the defendant updated
the plaintiff on efforts to obtain and produce records, and
(6) whether the defendant provided information about when records
could be expected.

Id.

The Auditor’s office reads Belin to specify two types of chapter 22 claims

that an aggrieved person may bring: (1) insufficiency claims and (2) delay claims.

It argues that Kirkwood’s petition raised only an insufficiency claim and that

when the Auditor’s office eventually produced the McCormally-Belin email,

Kirkwood’s insufficiency claim then became moot. It notes that Kirkwood never

amended its petition to raise a delay claim, even after receiving the McCormally-

Belin email, and thus argues that Kirkwood can’t pursue a delay claim on appeal.

Kirkwood, in response, argues that the text of § 22.10 simply specifies a cause

of action for “refusal” to produce records and that Belin didn’t carve chapter 22

claims into two categories for pleading purposes.

Kirkwood offers the correct reading. In Belin, we described insufficiency

and delay as merely two ways that a custodian could demonstrate a refusal to

produce documents under chapter 22. Id. at 171–74. The statute doesn’t set up

distinct causes of action for these two methods. See Iowa Code § 22.10. Further,

the statute imposes no requirement that a plaintiff plead a particular method of

refusal with specificity. Id. Under Iowa’s liberal notice pleading standards,

Kirkwood sufficiently alleged a claim for refusing to produce records under

chapter 22. It was under no obligation to plead, or amend its petition to plead, a

claim specifying refusal by delay.

To the extent that the McCormally-Belin email has already been produced,
Kirkwood’s request to compel turnover of a produced record is indeed moot since
 12

an order to produce documents that were already provided would have no prac-

tical importance or effect. Belin, 989 N.W.2d at 171. Although we may address a

moot question “where matters of public importance are presented and the prob-

lem is likely to recur,” neither exception to the mootness doctrine applies to the

production of this email. Id. (quoting Homan v. Branstad, 864 N.W.2d 321, 330

(Iowa 2015)).

But Kirkwood’s claim doesn’t merely seek to compel turnover of records.

Kirkwood recites our statement in Belin that “[a]lthough mootness prevents the

issuance of a court order to produce the already-produced records, mootness

would not bar any other relief that may be available under the Act, e.g., attorney

fees incurred in filing suit to compel production.” Id. (emphasis omitted). Kirk-

wood’s pursuit of a civil penalty, attorney fees, and court costs under chapter 22

based on a refusal to timely produce the McCormally-Belin email chain is not

moot. See id.

We turn to whether the failure to timely produce the email constitutes a

violation of the statute. The Auditor’s office argues that we should affirm the

district court ruling finding no violation because any delay in producing the

email was reasonable. See id. at 174 (discussing “an implied or ‘silent’ refusal”
that can be proved “through an unreasonable delay in producing records”). It

argues that Kirkwood’s claim is like the one we rejected in Klein v. Iowa Public

Information Board, where we held in part that the plaintiff “lacked standing to

seek judicial review with respect to records that were already publicly available.”

968 N.W.2d 220, 235 (Iowa 2021). Kirkwood can’t prove a refusal to produce the

email under chapter 22, the Auditor’s office argues, because the email’s contents

were already publicly available on the Bleeding Heartland blog, as recognized in

Kirkwood’s own petition quoting it.
 13

We believe that there is a factual issue question whether the delay in

producing the McCormally-Belin email was reasonable. To begin with, Kirkwood

could not know whether the blog post reflected the full, accurate contents of the

email. Unlike in Klein, the actual record in this case had not been produced. See

id. The Auditor’s office, in its answer to Kirkwood’s petition, refers to the portion

posted on the blog as “excerpted.” Kirkwood was entitled to see the actual,

complete record. See Iowa Code § 22.2 (providing that “[e]very person shall have

the right to examine and copy a public record” and that “[a]ll rights under this

section are in addition to the right to obtain a certified copy of a public record”).

The Auditor’s office recites the lengthy response delays that we held vio-

lated chapter 22 in Belin to argue the reasonableness of the delay in producing

the McCormally-Belin email here. Iowa Code § 22.8(4) provides that a “[g]ood-

faith, reasonable delay by a lawful custodian in permitting the examination and

copying of a government record is not a violation” of chapter 22. The Auditor’s

office notes that in Belin, the records requests went without a response for

months—one went for eighteen months—before the custodian produced the rec-

ords. See Belin, 989 N.W.2d at 167. The Auditor’s office points out that, in this

case, it immediately began working on Kirkwood’s request, explained its efforts
to locate all responsive emails, updated Kirkwood on the status of the request,

and provided a rolling production of documents.

These facts weigh in favor of the Auditor’s office, but they do not explain

the delay in producing the McCormally-Belin email. The Auditor’s office never

produced it with the initial open records request. Kirkwood put the Auditor’s

office on notice of the failure to produce this email when Kirkwood filed its peti-

tion by specifically identifying the email as improperly withheld. Kirkwood even

pasted into the body of its petition a screenshot of the Bleeding Heartland blog
post. This, Kirkwood argues, should have triggered prompt action to turn over
 14

the email or to explain the legal basis for withholding it. Yet the Auditor’s office

still didn’t produce the email until it responded to Kirkwood’s discovery requests

in the lawsuit—106 days after Kirkwood filed its petition and 216 days after the

open records request.

Kirkwood presented enough evidence to permit a factfinder to conclude

that, as to this email, the Auditor’s office’s delay was unreasonable. Once a plain-

tiff establishes a prima facie case, “the burden of going forward [is] on the de-

fendant to demonstrate compliance with the requirements of [chapter 22].” Iowa

Code § 22.10(2). “[W]hether a party’s conduct is reasonable,” we have said, “is

usually a fact question.” Knake v. King, 492 N.W.2d 416, 417 (Iowa 1992) (per

curiam). We conclude that an issue of fact exists as to whether the Auditor’s

office unreasonably delayed in providing the McCormally-Belin email and thus

failed to comply with chapter 22. We reverse the district court’s summary judg-

ment ruling in favor of the Auditor’s office concerning this email and remand for

further proceedings.

B.

We turn to the part of the ruling granting summary judgment on the

Auditor’s office’s withholding of the nine emails under Iowa Code § 11.42.
First, some background about the statutory powers and obligations of the

Auditor of State. Chapter 11 of the Iowa Code provides that “[t]he auditor of state

shall annually, and more often if deemed necessary, audit the state and all state

officers and departments receiving or expending state funds.” Id. § 11.2(1). The

law grants the Auditor “broad access to all information when conducting an au-

dit,” including “all information, records, instrumentalities, and properties used

in the performance of the audited or examined entities’ statutory duties or con-

tractual responsibilities . . . [and] full access to all papers, books, records, and
 15

documents of any officers or employees.” Sand v. Doe, 959 N.W.2d 99, 106 (Iowa

2021) (quoting Iowa Code § 11.41(1)–(2)).

Chapter 11 also imposes obligations on the Auditor to maintain the confi-

dentiality of records used in performing its duties, stating:

If the information, records, instrumentalities, and properties sought
by the auditor of state are required by law to be kept confidential,
the auditor of state shall have access to the information, records,
instrumentalities, and properties, but shall maintain the confiden-
tiality of all such information and is subject to the same penalties
as the lawful custodian of the information for dissemination of the
information.

Iowa Code § 11.41(3).

The Auditor’s office sought to withhold nine emails under § 11.42(1), which

provides: “Notwithstanding chapter 22, information received during the course

of any audit or examination, including allegations of misconduct or noncompli-

ance, and all audit or examination work papers shall be maintained as confiden-

tial.” Kirkwood argues that the Auditor’s office’s communications with reporters

Belin and Foley do not constitute “information received during the course of any

audit or examination” and thus were improperly withheld. The Auditor’s office

responds by highlighting the ensuing text that states such information includes

“allegations of misconduct or noncompliance,” and it asserts that communica-

tions with reporters about allegations of misconduct or noncompliance unques-

tionably fits within the statute.

Whether an email was properly withheld as “information received during

the course of any audit or examination” first requires a legal determination about

what constitutes an audit or examination, followed by a factual determination

about whether a document pertains to and was received during the course of it.

Id. Although the Code does not define “audit,” in Sand v. Doe, we described an
audit “as ‘a snapshot of a client’s financial condition at a given time.’ ”
 16

959 N.W.2d at 106–07 (quoting Eldred v. McGladrey, Hendrickson & Pullen,

468 N.W.2d 218, 220–21 (Iowa 1991)). Black’s Law Dictionary defines “audit” as

“[a] formal examination of an individual’s or organization’s accounting records,

financial situation, or compliance with some other set of standards.” Audit,

Black’s Law Dictionary 161 (11th ed. 2019). The Code does define an

“examination” under chapter 11 as meaning “procedures that are less in scope

than an audit but which are directed toward reviewing financial activities and

compliance with legal requirements.” Iowa Code § 11.1(b).

In Sand, we held that an initial email request for information from the

Auditor to a state agency did not constitute an audit for purposes of § 11.42 and

thus was not subject to the statute’s confidentiality protections. 959 N.W.2d at

109. We noted that “[t]he initial emails were casual (‘Please call me Rob’) and

could be construed as requests for follow-up information from [a] meeting rather

than formal demands for documents as part of an audit.” Id. But while we stated

that “[a]udits generally require specific objectives and identified standards

against which the objectives are measured,” this “does not mean the auditor of

state is necessarily required to provide a formal engagement letter identifying

those objectives and standards to initiate an audit.” Id.
For each of the withheld emails, the Auditor’s office provided a short sum-

mary of the email’s contents and the basis for withholding. Here’s one example:

1. 4.7.21

2. email thread between Laura Belin and Sonya Heitshusen

3. Includes info Belin’s research into CRF expenditures.

4. This email constitutes “Information received in the course of an
audit[”] under 11.42.

5. N/A
 17

6. This information relates to an ongoing audit of federal expendi-
tures. Audit reports issued in November 2021 and June 2021,
may or may not have utilized this information and/or some of the
information therein may have been disclosed pursuant to Iowa
Code 11.28 and 11.42 (3). Subsequent reports referencing this
information may be issued as deemed necessary.

The district court’s ruling did not separately address each email and thus

did not identify what it was about each email that it found satisfied the require-

ments of § 11.42. In its ruling on Kirkwood’s motion for reconsideration, the dis-

trict court stated that providing details for its ruling “would necessarily involve

discussion of confidential and privileged information” and thus “would frustrate

the purpose of the court’s in-camera review.” As a result, the district court “de-

cline[d] to go into the details of the information revealed by its in-camera review

other than to state the Court’s ruling is fully supported by the facts and appli-

cable Iowa law.”

We are not persuaded that each of these emails, as a matter of law, is

covered by § 11.42. For example, some are in the form of a request for infor-

mation from the reporter to the Auditor’s office. Under these circumstances,

where the connection between the email and an actual audit or examination is

not immediately apparent, summary judgment should be reversed. On remand,

the Auditor’s office should present evidence for each email to establish that the
specific email was actually received in the course of an audit or examination,

such as the specific audit or examination to which it relates, a copy of any audit

report, and the start and end dates of the audit or examination.

C.

The Auditor’s office withheld the tenth email under Iowa Code § 22.7(18).

This statute requires that a government body keep a public record confidential

if the record constitutes
 18

[c]ommunications not required by law, rule, procedure, or contract that
are made to a government body or to any of its employees by identified
persons outside of government, to the extent that the government body
receiving those communications from such persons outside of government
could reasonably believe that those persons would be discouraged from
making them to that government body if they were available for general
public examination.

Iowa Code § 22.7(18).

This exception is itself subject to several exceptions. See id.

§ 22.7(18)(a)–(c). Reciting these exceptions, Kirkwood argues that the Auditor’s

office did not explain why disclosure would discourage the public from providing

information, did not indicate whether it had sought consent from the member of

the public to disclose the communication, and failed to show that the release of

the information would jeopardize a person or a continuing investigation.

In Ripperger v. Iowa Public Information Board, we observed that § 22.7(18)

permitted public bodies to keep certain categories of useful information confi-

dential when the record custodian could reasonably believe that members of the

public otherwise might not provide the information if they knew it might be pub-

licly disclosed. 967 N.W.2d 540, 552–53 (Iowa 2021). “This is an objective test,

from the perspective of the record custodian, not the [Iowa Public Information]

Board or district court.” Id. at 553. We believe that one of those categories rea-

sonably includes information from tipsters or whistleblowers about “illegal or

unbusinesslike practices” that the Auditor’s officer is required to investigate.

Iowa Code § 11.4(1)(c). Chapter 22 imposes no duty on government bodies to

affirmatively contact every person who has submitted a record subject to this

statute to obtain consent for disclosure. In Ripperger, for instance, the requestor

sought records about thousands of people who asked to remove themselves from

a county assessor’s online property search database. 967 N.W.2d at 544. We
didn’t require the assessor to prove that it had contacted each person to show
 19

compliance with the statute. Id. at 551–54. We likewise find no such duty applied

here.

The district court, after reviewing the email, held that it fell within the

exception created in § 22.7(18) and that none of the exceptions to the exception

applied. Based on our review of the email, we find no error in the district court’s

conclusion. We note that this email is not connected to the two investigative

reporters and was sent by a member of the public. The email is (1) not required

by law and (2) made to a government body (3) by someone outside government,

and (4) the Auditor’s office could reasonably believe that the sender would be

discouraged from making such communications if the Auditor’s office publicly

disclosed it. See id. § 22.7(18). We thus affirm the ruling granting summary judg-

ment in the Auditor’s office’s favor on the tenth email withheld under § 22.7(18).

III.

We reverse the district court’s granting of summary judgment in favor of

the Auditor’s office on the McCormally-Belin email and the withholding of the

nine emails under § 11.42, affirm the district court’s granting of summary judg-

ment on the Auditor’s office’s withholding of the tenth email under § 22.7(18),

and remand for further proceedings.
AFFIRMED IN PART, REVERSED IN PART, AND REMANDED.