Audit of the Department of Conservation and Recreation Objectives, Scope and Methodology

An explanation of what this audit examined and how it was conducted.

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor (OSA) has conducted a performance audit of certain activities of the Department of Conservation and Recreation (DCR) for the period July 1, 2015 through June 30, 2017.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is our audit objective, indicating the question we intended our audit to answer, the conclusion we reached regarding the objective, and where it is discussed in the audit findings.

Objective	Conclusion
Did DCR implement corrective actions to adequately address all the issues identified in our previous audit report (No. 2012-0276-3S) pertaining to its Long-Term Permits and Leases (P&L) programs?	No; see Findings 1, 2, 3, and 4 and Other Matters

We gained an understanding of the DCR internal controls we deemed significant to our audit objective and evaluated the design of these controls. In addition, we performed the following procedures:

• We asked DCR officials about all outstanding use agreement fees related to the prior audit. We verified all payments and write-offs for these fees by querying the Massachusetts Management Accounting and Reporting System (MMARS) and comparing the data obtained to the documentation DCR provided to us regarding these fees to determine whether these payments were made.
• We selected a nonstatistical judgmental sample of 8 of the 24 monthly revenue reports of Long-Term Permits and Leases Unit revenue from the audit period. We verified that the cash receipts were properly recorded and accounts receivable were being updated.
• We asked P&L Unit management about the revision of the fair market rate changes for boat and yacht clubs, utilities, and employee housing. We verified the P&L Unit’s revised boat and yacht club fees and confirmed that all boat and yacht club users were charged the new rates for both fiscal years of our audit. We reviewed all 89 accounts that had been outstanding for 120 days or more to determine whether DCR had referred them to the Office of the State Comptroller for intercept⁴ or to a debt collection agency.
• We performed a nonstatistical test of 64 out of 725 use agreements to determine whether they had been signed; whether unexpired, active insurance binders were on file; whether insurance binders listed DCR as the additional insured; and whether property inspections had been conducted.
• We reviewed the prior audit finding regarding all 20 use agreements (16 concession stands and 4 skating rinks) that had been found not to have current use agreements as of June 30, 2011 to determine their status as of June 30, 2017.

In 2014, OSA performed a data-reliability assessment of MMARS. As part of this assessment, we tested general information technology controls for system design and effectiveness. We tested for accessibility of programs and data, as well as system change management policies and procedures for applications, configurations, jobs, and infrastructure.

During our current audit, we performed analytical procedures, such as comparing and reconciling available revenue summary totals in the applicable DCR accounts in the MRI application operated by DCR’s contractor, to confirm that the MMARS information we used was consistent with other source documentation (e.g., bank statements, canceled checks, and billing invoices). For the MRI application, we reviewed certain information system general controls for security management, access controls, and configuration management. For LandTracker (a repository application for tracking properties and use agreements), which had not been fully implemented by DCR’s contractor during our audit period, we performed tests for security management, access controls, and configuration management, and we compared hardcopy use agreements with information in LandTracker. Based on the above factors, we concluded that the data used were sufficiently reliable for the purposes of our audit.

We used nonstatistical sampling to help us achieve our audit objectives and therefore did not project our results to the various populations.

4. Intercept is an action that the Office of the State Comptroller can take through MMARS to withhold funds, such as state tax refunds owed or scheduled to be paid to a debtor, to discharge a debt owed to the Commonwealth.

Date published:	June 14, 2018