In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of Merrimack Valley Transit (MeVa) for the period July 1, 2022 through June 30, 2024.
We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.
| Objective | Conclusion |
|---|---|
| No; see Finding 1 |
| No; see Finding 2 and Other Matters 1 |
To accomplish our audit objectives, we gained an understanding of the internal control environment relevant to our objectives by reviewing applicable policies and procedures and by interviewing MeVa staff members, management, and contracted operating company employees. In addition, to obtain sufficient, appropriate evidence to address our audit objectives, we performed the procedures described below.
Safety Trainings
To determine whether MeVa ensured that employees of its contracted operating companies received required safety trainings in accordance with 49 CFR 673.29(a)(1), MeVa’s Public Transportation Agency Safety Plan, and the “Progressive Discipline Policy” for each of MeVa’s contracted operating companies, we took the following actions:
- We obtained, from MeVa’s chief compliance officer, a list of 160 employees who were employed by MeVa’s two contracted operating companies during the audit period. From this list, we identified 45 employees who were hired during the audit period and were required to complete newly hired employee safety training. We selected a judgmental5 sample of 10 out of the 45 newly hired employees of MeVa’s contracted operating companies.
- We inspected training attendance logs to determine whether each of the 10 sampled newly hired employees of MeVa’s contracted operating companies completed newly hired employee safety training as part of their onboarding, in accordance with MeVa’s Public Transportation Agency Safety Plan.
- We inspected training attendance logs to determine whether the contracted operating companies provided quarterly safety refresher trainings, in accordance with MeVa’s Public Transportation Agency Safety Plan.
- From the list of 160 employees who were employed by MeVa’s two contracted operating companies during the audit period, we identified 135 employees who were required to complete de-escalation training. We grouped these employees into two categories: 122 employees who were hired before July 2023—when MeVa first implemented de-escalation training—and 13 employees who were hired after July 2023 and were required to complete de-escalation training as part of their onboarding. We reviewed training attendance logs to determine whether all 135 of these employees completed de-escalation training in accordance with MeVa’s Public Transportation Agency Safety Plan.
- We obtained 158 discipline log entries from MeVa and filtered the data to identify 47 disciplinary violations that were related to preventable accidents. We reviewed all 47 discipline log entries to identify 31 employees of MeVa’s contracted operating companies who had been in documented preventable accidents that prompted retraining during the audit period. MeVa was unable to provide sufficient evidence to demonstrate that any of these 31 employees of MeVa’s contracted operating companies completed the required retrainings.
We used judgmental sampling methods for testing and, therefore, did not project the results of our testing to any population.
For this objective, we found certain issues during our testing regarding employees of MeVa’s contracted operating companies not completing required safety trainings. See Finding 1 for information.
ADA Paratransit Complaints
To determine whether MeVa took corrective action to address the issue identified in our prior audit (Audit No. 2022-0496-3A) regarding ADA paratransit complaints, we reviewed the Incident/Complaint forms for all 10 ADA paratransit complaints that MeVa received during this audit period. We then determined whether MeVa acknowledged the complaints within 24 hours, reviewed and investigated the complaints, and responded to the complainants to notify them of the complaint outcomes.
For this objective, we found certain issues during our testing regarding MeVa’s ADA paratransit complaint process. See Finding 2 for more information.
Data Reliability Assessment
To assess the reliability of the employee list from MeVa’s two operating companies contracted during the audit period, we tested the data to ensure that it did not contain certain dataset issues (i.e., duplicate records, blank fields, hidden rows or columns, and dates outside the audit period). We selected a random sample of 20 employees from the list and verified their names and employment dates against hardcopy personnel files to ensure accuracy. We also randomly selected 20 hardcopy personnel files and traced the employee names back to the list to confirm completeness.
To assess the reliability of MeVa’s contracted operating companies’ disciplinary logs, we tested the data to ensure that it did not contain certain dataset issues (i.e., duplicate records, blank fields, hidden rows or columns, and data corresponding to dates outside the audit period). Additionally, we selected a random sample of 20 log entries and compared the names of the employees of MeVa’s contracted operating companies, and the dates of the disciplinary actions taken, to the written warnings in personnel files to ensure accuracy. We also selected a random sample of 20 written warnings from personnel files and traced the employee names and dates of the disciplinary actions taken to the disciplinary log to confirm completeness.
We originally obtained complaint logs from MeVa’s contracted operating companies for the audit period. Our review of these logs found that key information was not consistently documented. In some instances, the logs lacked details regarding the nature of the complaint, its validity, the outcome, and whether the complaint was related to ADA-required paratransit. As a result of these inconsistencies, we requested all hardcopy Incident/Complaint forms filed with MeVa during the audit period to obtain more information. In response, MeVa provided 222 hardcopy Incident/Complaint forms for our review. Based on the information recorded in the forms, MeVa’s contracted operating companies identified 10 of the 222 MeVa rider complaints as ADA paratransit complaints. Our review of these 222 Incident/Complaint forms identified limitations in the completeness and consistency of complaint documentation, which are disclosed in Other Matters 1.
As a follow-up to the findings of our prior audit (2022-0496-3A), we reviewed select information systems controls, including security training, personnel screening, unsuccessful login attempt limits, session lock, account management, configuration management policies, configuration change monitoring, and segregation of duties. Our review of these controls found limitations with MeVa’s account management controls, which are disclosed in Other Matters 2.
Based on the results of the data reliability assessment procedures described above, we determined that the information we obtained during the course of our audit was sufficiently reliable for the purposes of our audit.
| Date published: | May 5, 2026 |
|---|