Overview
In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor (OSA) has conducted a performance audit of certain activities of the Massachusetts Office for Victim Assistance (MOVA) for the period January 1, 2019 through December 31, 2020.
We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
Below is a list of our audit objectives, indicating each question we intended our audit to answer and the conclusion we reached regarding each objective.
|
Objective |
Conclusion |
|
Yes; see Other Matters |
|
Yes |
In performing our audit work, we found that MOVA did not conduct cybersecurity awareness training as required by the standards of the Executive Office of Technology Services and Security; we discuss this issue in Finding 1.
To achieve our audit objectives, we gained an understanding of MOVA’s internal control environment as it related to the objectives by reviewing MOVA’s most recent internal control plan, policies, and procedures, as well as conducting inquiries with MOVA management and other agency staff members involved in the activities under review. We tested the effectiveness of MOVA’s controls over receipt and use of funds related to the Garden of Peace.
We performed the following procedures to obtain sufficient, appropriate audit evidence to address the audit objectives.
Information on Victim and Witness Rights and Services
To determine whether MOVA printed information about victim and witness rights and services and made it available to medical facilities, social service organizations, and law enforcement agencies as required by Sections 4(a), 4(b), and 4(c) of Chapter 258B of the General Laws, we obtained and reviewed copies of the written materials that MOVA supplied on victim and witness rights. We verified that MOVA provided this information to the organizations on its distribution log by matching the log to email requests for printed materials from medical facilities, social service organizations, and law enforcement agencies as well as shipping documents. This match enabled us to confirm that the requested information was mailed to each group that emailed a request. In addition, to ensure that MOVA made information available electronically, we determined whether the Massachusetts Victim Bill of Rights: Understanding Your Rights as a Crime Victim brochure links on MOVA’s website worked.
Finally, we selected a judgmental, nonstatistical sample of 14 training events from MOVA’s list of the 34 training events it said it hosted during our audit period to comply with Sections 4(b) and 4(c) of Chapter 258B of the General Laws. We reviewed the agenda for each sampled training event to confirm that each event was associated with providing information on victim and witness rights.
Administration of the Garden of Peace
To determine whether MOVA administered the operations of the Garden of Peace in accordance with Section 4(e) of Chapter 258B of the General Laws, we performed a site visit to the Garden of Peace and observed that MOVA was properly physically maintaining it. We selected a judgmental, nonstatistical sample of 15 of the 74 deposits attributable to the Garden of Peace Trust Fund during the audit period from MOVA’s accounting records and verified each deposit amount by reviewing and reconciling the related checks, deposit slips, and bank statements. Using information in the Commonwealth’s accounting system, the Massachusetts Management Accounting and Reporting System (MMARS), we randomly selected 9 of the 23 expenditures from the fund during the audit period. These expenditures totaled $28,472 and represented 93% of the total $30,640 in expenditures from the fund during the audit period. We confirmed that the expenditures were properly authorized, invoiced, paid, and recorded.
We used a nonstatistical sampling method for our audit objectives and did not project the results from the samples to the populations.
Data Reliability
In 2018, OSA conducted a data-reliability assessment of MMARS. As part of this assessment, OSA tested general information technology controls for system design and effectiveness. During the current audit, we tested cybersecurity training (see Finding 1) and personnel screening. We also reconciled MOVA’s revenue tracking sheets and expenses to those in MMARS. In addition, we conducted interviews with MOVA management officials who were knowledgeable about the financial information provided.
During the current audit, we noted that MOVA did not maintain a list of all organizations that provided victim and witness assistance services in the Commonwealth (see Other Matters). Therefore, we conducted Internet research and attempted to identify all medical facilities, social service organizations, and law enforcement agencies in the Commonwealth that addressed victim and witness issues and concerns. Examples of information that we researched and used to compile our list include an online directory of Massachusetts district attorneys’ offices, the Massachusetts Department of Public Health’s list of certified medical facilities, and the most recent data from the United States Department of Justice’s Bureau of Justice census of law enforcement agencies.
We checked the accuracy of MOVA’s distribution log by tracing all the information from the log (for a total of 18 organizations) to information in source documents (United Parcel Service invoices for shipping brochures). We checked the training list MOVA provided for accuracy by selecting a judgmental, nonstatistical sample of 14 of the 34 training events that MOVA said it hosted during the audit period and matching the title and date of each item in the sample to source documents (agendas and evaluations). We could not determine the completeness of the distribution log or the training list, but the lists are relevant and the sole sources to determine the populations of brochures shipped and training events provided during the audit period.
Based on the work performed, we determined that the information obtained for our audit period was sufficiently reliable for the purposes of our audit work.
| Date published: | March 4, 2022 |
|---|