Audit of the Department of Conservation and Recreation Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the Department of Conservation and Recreation.

Overview

 

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor (OSA) has conducted a performance audit of certain activities of the Department of Conservation and Recreation (DCR) for the period July 1, 2019 through June 30, 2021.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer, the conclusion we reached regarding each objective, and where each objective is discussed in the audit findings.

Objective	Conclusion
Does DCR have internal tracking, oversight, and enforcement procedures to ensure compliance with its workforce participation goal under Section 44A(1)(G) of Chapter 149 of the General Laws?	No; see Finding 1
Does DCR ensure that construction contracts under Chapters 30 and 149 of the General Laws meet its business ownership goal for women and minorities in accordance with Section 8 of Part 1 of its “Instructions to Bidders”?	No; see Finding 2

 

In performing our audit work, we also found that not all DCR employees promptly received cybersecurity awareness training, as discussed in Finding 3.

To achieve our objectives, we gained an understanding of DCR’s internal control environment related to the objectives by reviewing contract requirements and conducting interviews with DCR officials. We evaluated the design, and tested the operating effectiveness, of internal controls related to the approval of construction contracts.

To obtain sufficient, appropriate audit evidence to address our audit objectives, we performed the following procedures.

To determine whether DCR had internal tracking, oversight, and enforcement procedures to ensure compliance with the workforce participation goal, we asked DCR officials about their procedures for tracking and overseeing the goal.

To determine whether DCR ensured that its contractors complied with the business ownership goal, we obtained a list of all construction contracts that were active during our audit period for which payments were made to a contractor. We selected a random, nonstatistical sample of 20 of the 99 contracts. For the sample, we obtained each contract’s letters of intent (which were used to document planned expenditures for each certified minority-owned business enterprise [MBE] and woman-owned business enterprise [WBE] to be used on the project), schedule of participation (which documented the percentages of the total contract expenditures that were intended to be made to MBEs and WBEs), and Supplier Diversity Office certification letters for planned subcontractors that were certified MBEs or WBEs. We examined these documents to determine whether DCR’s construction contracts documented planned spending on MBEs and WBEs.

Using the same population of 99 active construction contracts, we generated an expenditure query from the state’s Massachusetts Management Accounting and Reporting System (MMARS) to determine the total expenses paid for all 99 contracts each fiscal year. Next, we calculated DCR’s total MBE and WBE expenses paid as a percentage of total expenses for fiscal years 2020 and 2021 to determine whether DCR met business ownership goals for women and minorities each year. To perform this calculation, we obtained copies of all Certificates of Payment⁴ that DCR received from the contractors on its construction contracts. We totaled all the MBE and WBE expenses on these reports for each fiscal year. To determine expenditures on MBEs and WBEs, we then divided the total MBE and WBE payments by the total paid construction contract expenses in MMARS for each fiscal year. If DCR did not receive any Certificates of Payment from an ongoing contract, we asked whether DCR had taken any enforcement action against the contractor.

We used nonstatistical sampling and therefore could not project the results of our testing to the overall populations.

Data Reliability Assessment

In 2018 and 2022, OSA performed a data reliability assessment of MMARS that focused on testing certain information system general controls, including access, cybersecurity awareness, audit and accountability, configuration management, identification and authentication, and personnel security. During the current audit, we obtained and reviewed DCR’s cybersecurity awareness policies and procedures, evidence of DCR’s employees being trained on cybersecurity, and evidence of background checks. (See Finding 3.)

DCR provided a Microsoft Excel spreadsheet listing 99 construction contracts that were active during our audit period. To determine the reliability of the spreadsheet, we randomly selected 12 DCR construction contracts from DCR’s list and traced them to DCR’s hardcopy construction contract files for agreement. We also randomly selected 12 hardcopy construction contract files and traced them to DCR’s list for agreement.

We generated an expenditure query from MMARS to include all DCR construction contract payments for the audit period. To determine the reliability of the query, we randomly selected 20 payments from the query and traced them to DCR’s payment vouchers for agreement. We also randomly traced a sample of 20 DCR payment vouchers to the query for agreement.

Based on the results of our data reliability assessments, we determined that the information obtained for our audit period was sufficiently reliable for the purpose of our audit objectives.

4.    Certificate of Payment reports list total payments made by the contractor to MBE and WBE subcontractors on a construction contract during a fiscal year.

Date published:	November 3, 2022