Audit of the Massachusetts Growth Capital Corporation Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the Massachusetts Growth Capital Corporation.

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of the Massachusetts Growth Capital Corporation (MGCC) for the period March 1, 2020 through June 30, 2022.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.

Objective	Conclusion
1.     Did MGCC administer the COVID-19 Small Business Relief Grant Program (SBRGP) in accordance with Section III of Amendment to Attachment A of the Small Business Relief Grant Program—Part II to ensure that funds were distributed to eligible businesses within eligible industries and that priority was given to underserved demographic groups?	No; see Findings 1, 2, and 3
2.     Did MGCC account for COVID-19 SBRGP funds received from the Executive Office of Economic Development (EOED) in accordance with its Grant Receipts & Control Procedures to ensure that the grant funds MGCC received matched the grant request amounts and were properly recorded to MGCC’s accounting records?	No; see Finding 6
3.     Did MGCC disburse the COVID-19 SBRGP funds to eligible businesses in accordance with Section III of Amendment to Attachment A of the Small Business Relief Grant Program—Part II to ensure that maximum amounts as stipulated in the contract were distributed to grant recipients and that these funds were used for allowable expenses?	No; see Finding 1
4.     Did MGCC follow reporting requirements in accordance with Section VII of Amendment to Attachment A of the Small Business Relief Grant Program—Part II to ensure that reports contained required information and were submitted according to stipulated timelines?	No; see Finding 5
5.     Did MGCC provide information security training to its employees responsible for the management, approval, and accounting of COVID-19 SBRGP funds when initially hired and on an ongoing basis as required by MGCC’s Written Information Security Policy (WISP)?	No; see Finding 4

To accomplish our audit objectives, we gained an understanding of the aspects of MGCC’s internal control environment that we determined to be relevant to our objectives by reviewing applicable policies and procedures and relevant contracts, by conducting interviews and walkthroughs with management, and by reviewing the processes related to our objectives. We evaluated the design of controls over the administration of grant applications, the accounting and disbursement of grant funds, the reporting of grants, and the administration of information security training. We also tested the operating effectiveness of controls over the administration of grant applications.

To obtain sufficient, appropriate evidence to address our audit objectives, we performed the following procedures. 

Sampling Strategy

For our first three objectives, we obtained a list of COVID-19 SBRGP grant recipients and chose a random, statistical sample⁴ of 60 out of the population of 14,066 COVID-19 SBRGP grant recipients, using a 95% confidence level,⁵ a 0% expected error rate,⁶ and a 5% tolerable error rate⁷ for our testing.

Administration of COVID-19 SBRGP Funds

To determine whether MGCC administered the COVID-19 SBRGP in accordance with Section III of Amendment to Attachment A of the Small Business Relief Grant Program—Part II, we performed the following procedures.

• For our sample of 60 COVID-19 SBRGP grant recipients, we examined grant applications, tax records, state Certificates of Good Standing, municipal business certificates, state licenses and registrations, MGCC’s scoring and prioritization records, reports on groups of approved applications, and internet searches to confirm certain details (e.g., each business’s location or its current certificate standing with the Secretary of the Commonwealth). We determined whether the grant recipients met the following qualifications:
• part of an eligible industry;
• located in Massachusetts;
• able to document a loss of income equal to or greater than the requested grant funding because of the COVID-19 pandemic;
• currently in operation and established before June 30, 2019;
• in good standing with the state and municipality;
• current on taxes due through March 1, 2020;
• in possession of valid state licenses/registrations, if applicable; and
• scored and prioritized by MGCC to give priority to businesses owned by underserved demographic groups (specifically businesses owned by people of color, women, and veterans). (See Finding 2 for more information.)
• During our review of the COVID-19 SBRGP applicant list, we identified 32 grant recipients with an out-of-state legal business address within our population. We verified the addresses by independently reviewing the MGCC SBRGP Package Grant List. We reviewed each of the 32 grant applications and determined that all 32 businesses had a physical location in Massachusetts and had a state Certificate of Good Standing or a business certificate for a municipality within Massachusetts.
• During our initial inquiry, we also investigated whether any of these 32 grant recipients were part of a chain,⁸ which would make them ineligible for the COVID-19 SBRGP. (See Finding 3 for further information.)

Accounting of COVID-19 SBRGP Funds

To determine whether MGCC accounted for COVID-19 SBRGP funds in accordance with its Grant Receipts & Control Procedures, we performed the following procedures.

• For our sample of 60 COVID-19 SBRGP grant recipients, we verified that grant receipt amounts matched requested amounts by confirming that each grant in our sample was part of an approved funding request MGCC sent to EOED. We also verified that each approved group was represented by an invoice sent by MGCC to EOED.
• We confirmed that MGCC accounting staff members properly recorded grant receipts from EOED to MGCC’s accounting records by reviewing receipt postings on MGCC’s accounting system to confirm that posting amounts matched requested amounts of grant funding.
• We then performed a reconciliation of overall COVID-19 SBRGP funding against the payment amounts for the program.

See Finding 6 for further information.

Disbursement of COVID-19 SBRGP Funds

We determined whether MGCC disbursed COVID-19 SBRGP funds to eligible businesses in accordance with Section III of Amendment to Attachment A of the Small Business Relief Grant Program—Part II to ensure that amounts as stipulated in the contract were distributed to recipients and that these funds were used for allowable expenses. To do this, we performed the following procedures.

• For our sample of 60 COVID-19 SBRGP grant recipients, we reviewed grant applications, tax records, and Automated Clearing House⁹ files and bank statements. We did this to determine whether (1) funds were disbursed to the grant recipients, (2) grant recipients provided required details regarding the use of these funds in their applications, and (3) the lesser of $75,000 or three months of eligible expenses—and no more—was distributed to grant recipients.

See Finding 1 for more information.

Reporting of COVID-19 SBRGP Funds

To determine whether MGCC followed reporting requirements in accordance with Section VII of Amendment to Attachment A of the Small Business Relief Grant Program—Part II to ensure that reports contained required information and were submitted according to stipulated timelines, we performed the following procedures.

• We determined whether MGCC management submitted both the initial and final reports by the required dates of January 31, 2021 and June 30, 2021, respectively.
• We also determined whether, if submitted by the required dates, these reports contained the following required information:
• program information (e.g., the number of grants and grant recipient demographics, such as priority group, location, and industry sector);
• financial information (e.g., grant amounts); and
• outcomes (e.g., job creation, job retention, economic impact, and revenue growth).

See Finding 5 for more information.

Information Security Training

To determine whether MGCC provided information security training to its employees responsible for the management, approval, and accounting of COVID-19 SBRGP funds when initially hired and on an ongoing basis, as required by MGCC’s WISP, we performed the following procedures.

• We obtained from MGCC a list of employees who worked at MGCC during the audit period.
• We identified a total of 10 employees who were responsible for managing and accounting for the COVID-19 SBRGP by interviewing MGCC management, reviewing job descriptions, and reviewing system access and approval documentation.
• We requested training certificates and reviewed employee files for evidence of training certificates for all 10 of these employees to determine whether they completed the required information security training.

See Finding 4 for more information.

Data Reliability Assessment

To determine whether grant funds were distributed, accounted for, and disbursed in accordance with COVID-19 SBRGP contract requirements and MGCC policies, respectively, we relied on data from MGCC’s grant application and accounting systems. To assess the reliability of this data, we performed the following procedures.

MGCC Grant Application List

To determine the reliability of the list of applications MGCC provided to us, we tested selected information system controls (security management, access controls, configuration management, segregation of duties, and contingency planning) and interviewed knowledgeable staff members at MGCC about the COVID-19 SBRGP applicant list and tested this list for hidden records and duplicate values. To test the list for completeness and accuracy, we reconciled grant recipient populations between the list received from MGCC and a direct system download of application data that we witnessed an MGCC employee completing. We also reconciled the total dollar amount of grants on the application list to contract amounts. In addition, we randomly selected 20 applications from each of the three major categories of grants financed by the COVID-19 SBRGP on the list (five or fewer employees, 50 or fewer employees, and Sector Specific) and randomly selected 10 applications from businesses that were part of MGCC’s small business recovery loan forgiveness program. We also selected the 2 applications for businesses from Sector Specific industries that resubmitted grant applications that were also financed by the COVID-19 SBRGP, giving us a total of 72 applications. We traced these 72 applications to source documents (tax returns and Internal Revenue Service Forms W-9) for the business name, the business address, and the owner’s Social Security number.

Accounting System

To determine the reliability of the data in MGCC’s accounting system, we tested selected information system controls (security management, access controls, configuration management, segregation of duties, and contingency planning), reviewed policies and procedures, and interviewed MGCC employees who were knowledgeable about the system. We judgmentally selected three credits, which totaled $163,695,000 of MGCC’s $650 million COVID-19 SBRGP award (and which were listed on the MGCC posting file downloaded from MGCC’s accounting system by the MGCC controller) and traced these credits to invoices that MGCC sent to EOED.

Employee List

To determine the reliability of the list of employees who worked at MGCC during the audit period, we checked this list for blank and duplicate values and hidden rows, columns, and worksheets. We identified employees responsible for managing COVID-19 SBRGP funds by interviewing MGCC management and by reviewing employee access and level of privileges on MGCC’s grant application and accounting systems. We also confirmed that each of the 10 employees identified as responsible for managing and/or accounting for COVID-19 SBRGP funds had either a physical personnel file or, if a temporary employee, an executed Internal Revenue Service Form W-9 and a signed confidentiality agreement.

Based on the results of the data reliability assessment procedures described above, we determined that the information obtained for the audit period was sufficiently reliable for the purposes of our audit. 

4.    Auditors use statistical sampling to select items for audit testing when a population is large (usually over 1,000) and contains similar items. Auditors generally use a statistics software program to choose a random sample when statistical sampling is used. The results of testing using statistical sampling, unlike those from judgmental sampling, can usually be used to make conclusions or projections about entire populations.

5.    Confidence level is a mathematically based measure of the auditor’s assurance that the sample results (statistic) are representative of the population (parameter), expressed as a percentage.

6.    Expected error rate is the number of errors that are expected in the population, expressed as a percentage. It is based on the auditor’s knowledge of factors such as prior year results, the understanding of controls gained in planning, or a probe sample.

7.    The tolerable error rate (which is expressed as a percentage) is the maximum error in the population that is acceptable while still using the sample to conclude that the results from the sample have achieved the objective.

8.    According to MGCC’s Sector Specific grant solicitation language, “chains are defined as businesses not headquartered in Massachusetts with multiple locations.”

9.    Automated Clearing House is a system used for electronic fund transfers between consumers and financial institutions.

 

Date published:	August 28, 2024