Audit of the Massachusetts Cultural Council Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the Massachusetts Cultural Council

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor (OSA) has conducted a performance audit of certain activities of the Massachusetts Cultural Council (MCC) for the period March 1, 2020 through March 31, 2021. For fiscal year 2021 grants issued to individuals, we extended the scope through June 30, 2021.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer, the conclusion we reached regarding each objective, and where each objective is discussed in the audit findings.

Objective	Conclusion
Did MCC administer funding from its appropriations and donations for the fiscal year 2020 and fiscal year 2021 COVID-19 Relief Fund for Individual Artists in accordance with its grant guidelines?	No; see Finding 1
Did MCC administer funding from the Cultural Organization Economic Recovery Program in accordance with its grant guidelines and its interdepartmental service agreement (ISA) with the Executive Office for Administration and Finance?	No; see Finding 2
Did MCC update its internal control plan (ICP) as required by the Office of the Comptroller of the Commonwealth’s (CTR’s) guidance dated September 30, 2020?	No; see Finding 3
Did MCC employees receive cybersecurity awareness training in accordance with Section 6.1.1 of the Executive Office of Technology Services and Security’s (EOTSS’s) Acceptable Use of Technology Policy IS.002, effective October 15, 2018, and Section 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010, effective October 15, 2018?	No; see Finding 4

 

To achieve our audit objectives, we gained an understanding of MCC’s internal control environment related to the objectives by reviewing applicable agency policies and procedures, as well as conducting inquiries with MCC’s staff and management. We evaluated the design of controls over grants to individuals, grants to cultural nonprofit organizations (NPOs), updates to the ICP, and cybersecurity awareness training.

We performed the following procedures to obtain sufficient, appropriate audit evidence to address the audit objectives.

Grants to Individuals

We recalculated the prorated percentages based on applications received and compared it to the percentages of grants awarded to individual artists in the six regions MCC had designated for the fiscal year 2020 COVID-19 Relief Fund for Individual Artists grants to determine whether funds were disbursed using the prorated percentages for each region.

We sorted the 1,603 applicants who were not awarded grants in fiscal year 2020 by the six regions and then by their assigned random numbers, from lowest to highest. We compared those numbers to the numbers assigned to applicants who received grants in the same regions to confirm that all applicants selected had lower random numbers than those who were not selected. For each of the 17 applicants we identified who had lower numbers than applicants who received grants, we inspected the application and the Contract Authorization Form that listed all the grantees and asked MCC management to verify that the applicant was ineligible.

We inspected the application of each of the 37 applicants for the fiscal year 2020 grant whom MCC deemed ineligible and who were not assigned random numbers, and we asked MCC management to confirm that each applicant was ineligible.

In addition, we inspected the application and Contract Authorization Form for funding for the 1 applicant who was not awarded a grant from the Gary Knisely and Varian (GKV) Foundation funding and the 35 who did not receive awards from the fiscal year 2021 COVID-19 Relief Fund for Individual Artists to confirm that the applicants were ineligible.

For all 1,071 applicants who were awarded grants (totaling $1,456,000) from the fiscal year 2020 COVID-19 Relief Fund for Individual Artists, fiscal year 2020 GKV Foundation donation, and fiscal year 2021 COVID-19 Relief Fund for Individual Artists during the expanded audit period (March 1, 2020 through June 30, 2021), we compared grant payments to the amounts in the applicable grant guidelines to determine that none of the grants awarded exceeded the amounts stipulated in the guidelines. We also requested supporting documentation to confirm that each applicant was a legal resident of Massachusetts; was 18 or more years old; reported that 25% of the applicant’s total taxable income was earned as an individual artist or independent teaching artist, humanist, or scientist in the applicant’s most recent tax return; and had lost at least $1,000 because of COVID-19.

For the 1,071 grantees who were paid from the fiscal year 2020 COVID-19 Relief Fund for Individual Artists, the fiscal year 2020 GKV Foundation donation, the fiscal year 2021 COVID-19 Relief Fund for Individual Artists, and $39,000 of ISA funding, we separated the population into three strata. Stratum 1 consisted of 1,026 individuals paid from the fiscal year 2020 COVID-19 Relief Fund for Individual Artists, fiscal year 2020 GKV Foundation donation, and fiscal year 2021 COVID-19 Relief Fund for Individual Artists. Stratum 2 consisted of all 19 grantees that had business names rather than individuals’ names. Stratum 3 consisted of all 26 individual grantees paid from the $39,000 of ISA funding for cultural NPOs. For Stratum 1, we sampled 47 grantees using a random, statistical selection with a 90% confidence level, 5% error rate, and 0% expected error rate. Our testing included all 19 grantees from Stratum 2 and all 26 grantees from Stratum 3. For all three strata (92 grantees) tested, we inspected the contracts, Requests for Taxpayer Identification Number and Certification, Electronic Funds Transfer Sign Up Forms, and Authorization for Electronic Funds Transfer Authorization Agreements to determine whether contracts were signed, whether the Massachusetts Management Accounting and Reporting System (MMARS) payment records agreed with the names and amounts on the contracts, and whether the names on the contracts agreed with the names on the Requests for Taxpayer Identification Number and Certification and both of the electronic fund transfer forms.

For the grants from the fiscal year 2020 COVID-19 Relief Fund for Individual Artists, fiscal year 2020 GKV Foundation donation, and fiscal year 2021 COVID-19 Relief Fund for Individual Artists, we compared all 1,071 grantee names to the list of MCC’s 53 employees and board members and their 114 affiliated corporations to confirm that no MCC employee, board member, or affiliated cultural NPO received grant funding.

Cultural Organization Economic Recovery Program Grants

We selected a nonstatistical, random sample of 35 grants (totaling $1,966,000) to cultural NPOs from the population of 183 such grants (totaling $9,960,600). To ensure that each grantee met eligibility requirements, we inspected each grantee file from our sample to determine whether it contained the following:

• A signed and dated contract between MCC and the cultural NPO. We examined the amount awarded according to the contract to ensure that it did not exceed the amount paid to the cultural NPO.
• A signed and dated Request for Taxpayer Identification Number and Certification (Form W-9).
• A signed and dated Contractor Authorized Signatory Listing.
• A signed and dated CTR Electronic Funds Transfer Authorization Agreement.
• A signed and dated Internal Revenue Service (IRS) Return of Organization Exempt from Income Tax.
• Documentation to support the requested amount, such as payroll reports, invoices, rental agreements, and loan statements.

We also examined the Office of the Secretary of the Commonwealth’s corporate database to determine whether each cultural NPO was formed before June 2019.

In our analysis of the scoring, we determined that 26 of the cultural NPO applications had scores higher than those of some cultural NPOs that had been awarded grants. We divided the 26 cultural NPOs into two strata based on the application status (“ineligible” or “unverified”) as determined by MCC. For Stratum 1, we selected a random, nonstatistical sample of 10 of the 22 applications that were marked ineligible. For this sample of 10, we verified that MCC had correctly determined ineligibility by reviewing the files for missing documentation, and we confirmed using the IRS’s Tax Exempt Organization Search tool that none of the applicants was registered as a cultural NPO. For Stratum 2, we selected all 4 applications with a status of “unverified” and a higher score than the cultural NPO that received the final grant. For all 4, we inspected the applicant’s file to determine whether MCC had verified the documentation that the applicant had provided based on the eligibility criteria for the Cultural Organization Economic Recovery Program.

We obtained a list of MCC employees and MCC board members from the audit period. We entered all employee and board member names in the Office of the Secretary of the Commonwealth’s corporate database to identify all the corporations with which the employees and board members were affiliated. We compared this list of 114 corporations and 53 employees and board members to a list of the 183 cultural NPOs that received grants, and the 44 aliases associated with these cultural NPOs, to confirm that no MCC employee or board member was affiliated with any cultural NPO that received grant funding.

When nonstatistical sampling methods were used, we could not project the results of our testing to the population.

ICP

We requested the ICPs for 2020 and 2021 that were prepared during the audit period to evaluate, so that we could determine whether they had been updated with COVID-19 guidance (as required by CTR’s Internal Control Guide because COVID-19 had caused a significant change to the work environment). We also examined a copy of the ICP to determine whether it contained the components required by CTR’s “COVID-19 Pandemic Response Internal Controls Guidance.”

Cybersecurity Awareness Training

We requested from MCC management all certificates of completion of cybersecurity awareness training for MCC employees during the audit period to determine whether they completed the training in accordance with CTR’s “COVID-19 Pandemic Response Internal Controls Guidance,” dated September 30, 2020; Section 6.1.1 of EOTSS’s Acceptable Use of Information Technology Policy IS.002; and Section 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010.

Data Reliability

Go Smart

We assessed the reliability of the data obtained from Go Smart by interviewing knowledgeable MCC personnel about online system access controls and segregation of duties. We observed MCC management exporting the list of all grant applications from Go Smart to Excel and generating Application by Status Reports, which totaled all applications received for each of the following grants:

• Fiscal year 2020 COVID-19 Relief Fund for Individual Artists: 2,044 applications
• Fiscal year 2021 COVID-19 Relief Fund for Individual Artists: 956 applications
• Fiscal year 2020 GKV Foundation Fund for Berkshire County Theater Professionals: 28 applications
• Fiscal year 2021 Cultural Organization Economic Recovery Program: 505 applications

We compared each grant’s Application by Status Report totals to the totals from the list of all grant applications from Go Smart to determine the completeness of the population. We analyzed the list of all grant applications from Go Smart for any hidden columns or rows. In addition, we ran data integrity tests to identify dates outside the audit period and checked for duplicate names and duplicate application numbers.

Pearl

We assessed the reliability of the data obtained from Pearl by interviewing knowledgeable MCC personnel about online system access controls and segregation of duties. To test the completeness of the data, we compared the Go Smart Application by Status Reports for each of the four grants to the Excel spreadsheets of application data from Pearl. We also tested the Excel spreadsheets of application data from Pearl for each grant for duplicate names and duplicate application numbers.

To test the accuracy of the data, we performed the following procedures:

• Fiscal year 2020 COVID-19 Relief Fund for Individual Artists: We compared the cities/towns applicants assigned by Pearl to MCC’s six defined regions to determine whether applicants were placed in the correct regions. We observed the method MCC used to generate a random identification number for each applicant to ensure that the method was random for all applicants. We then traced a random sample of 20 grant applications to and from Go Smart and Pearl to confirm that names, application numbers, and application statuses matched.
• Fiscal year 2021 COVID-19 Relief Fund for Individual Artists: We traced a random sample of 20 grant applicants to and from Go Smart and Pearl to confirm that names, application numbers, and application statuses matched.
• Fiscal year 2020 GKV Foundation Fund for Berkshire County Theater Professionals: We traced a random sample of 5 grant applicants to and from Go Smart and Pearl to confirm that names, application numbers, and application statuses matched.
• Fiscal year 2021 Cultural Organization Economic Recovery Program: We traced a random sample of 20 grant applicants to and from Go Smart and Pearl to confirm that names, application numbers, and application statuses matched.

MMARS

In 2018, OSA performed a data reliability assessment of MMARS that focused on testing selected system controls (access controls, configuration management, contingency planning, and segregation of duties) for the period April 1, 2017 through March 31, 2018. As part of our current audit, we asked MCC management for the agency’s cybersecurity awareness policy and personnel security policy and procedures. We tested system authorization for all four employees who had access to MMARS during the audit period. We requested certificates of completion of cybersecurity awareness training for all employees (see Finding 4).

We analyzed the data to verify that all data were within our audit period. To test the data for completeness, we compared fiscal year 2020 COVID-19 Relief Fund for Individual Artists, fiscal year 2020 Gary Knisely and Varian, fiscal year 2021 COVID-19 Relief Fund for Individual Artists, and Cultural Organization Economic Recovery Program grant payments recorded in MMARS to payments reported on MCC’s website in its published press releases. To test the data for accuracy, we selected a random sample of 65 of 1,254 MMARS grant payments and traced them to the Excel spreadsheets of application data from Pearl and signed Contract Authorization Forms for the corresponding grants.

Based on the results of our data reliability assessments, we determined that the information obtained for our audit period was sufficiently reliable for the purpose of our audit objectives.

Date published:	June 16, 2022