Audit of the Worcester County District Attorney’s Office Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the Worcester County District Attorney’s Office.

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of the Worcester County District Attorney’s Office (WCDA) for the period July 1, 2019 through June 30, 2021. When reviewing updates to its internal control plan (ICP), we examined WCDA’s most recent ICP as of the time of our audit work, which was dated March 2022.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.

Objective	Conclusion
Did WCDA make all forfeited fund expenditures in compliance with Section 47(d) of Chapter 94C of the General Laws?	Yes
Did WCDA process and track all confiscated funds in accordance with its “Fiscal Policy and Procedures” to ensure that all funds are properly accounted for?	Yes
Did WCDA process and track all forfeited funds in accordance with its “Fiscal Policy and Procedures” to ensure that all funds are properly accounted for?	Yes
Did WCDA update its ICP to address the 2019 coronavirus (COVID-19) pandemic, in accordance with the Office of the Comptroller of the Commonwealth’s (CTR’s) “COVID‑19 Pandemic Response Internal Controls Guidance,” dated September 30, 2020?	Yes
Did WCDA ensure that its employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of the Executive Office of Technology Services and Security’s (EOTSS’s) Information Security Risk Management Standard IS.010?	No; see Finding 1

 

To achieve our audit objectives, we gained an understanding of WCDA’s internal control environment related to the objectives by reviewing applicable policies and procedures and interviewing WCDA officials. We evaluated the design, and tested the operating effectiveness of, internal controls related to the approval of forfeited fund expenditures, the verification of amounts of confiscated funds received from law enforcement agencies, and the monthly reconciliation of confiscated and forfeited funds.

To obtain sufficient, appropriate audit evidence to address our audit objectives, we performed the following procedures.

Forfeited Fund Expenditures

To determine whether WCDA made forfeited fund expenditures in compliance with Section 47(d) of Chapter 94C of the General Laws, we performed the following procedures.

• WCDA provided us with a list of all forfeited fund expenditures for the audit period from QuickBooks. Total forfeited fund expenditure activity for the audit period consisted of 861 transactions, totaling $969,138. We split the population of forfeited fund expenditures into two categories based on the type of expenditure: financial assistance awards given to community programs and all other expenditures.
• We selected a random, nonstatistical sample of 20 of the 106 financial assistance awards that WCDA gave to community programs. We examined each community program’s completed Funds Request Form, spending report, and supporting documentation (invoices and receipts) to validate the nature and purpose of the expenditures.
• We also selected a random, nonstatistical sample of 35 of the 755 other forfeited fund expenditures. We reviewed supporting documentation (payment requests, invoices, and receipts) to determine whether each expenditure was supported by adequate documentation and was allowable under Section 47(d) of Chapter 94C of the General Laws.

Confiscated Funds

To determine whether WCDA processed and tracked all confiscated funds in accordance with its “Fiscal Policy and Procedures,” WCDA provided us with a list of all 659 of WCDA’s open confiscated fund cases during the audit period from the District Attorney Management Information Office Network (DAMION)³ case management system. We selected a nonstatistical, random sample of 30 of the 659 cases for testing.

• For 14 of the 30 cases selected for testing, the confiscated funds were being held by either the local or state police department (PD) that seized the funds. For these 14 cases, we examined the Request for Asset Forfeiture Forms to determine whether case information was accurately recorded in the electronic spreadsheet WCDA’s Fiscal Unit maintains.
• WCDA held confiscated funds from the remaining 16 cases selected for testing. For these cases, we examined Request for Asset Forfeiture Forms and deposit slips to determine whether case information was accurately recorded in WCDA’s Fiscal Unit open case database and that the funds were deposited into WCDA’s confiscated funds trust account.

Forfeited Funds

To determine whether WCDA processed and tracked all forfeited funds in accordance with its “Fiscal Policy and Procedures,” WCDA provided us with a list of all 383 of WCDA’s forfeited fund cases that were closed during the audit period from DAMION. We selected a nonstatistical, random sample of 25 of the 383 cases.

• For 11 of the 25 cases selected for testing, the local or state PD that seized the funds held the forfeited funds. For these 11 cases, we examined forfeiture orders, checks, intake sheets, and deposit slips to determine whether (1) the amount of forfeited funds collected was accurate, (2) the forfeited funds were deposited into WCDA’s Bank of America forfeited funds sweep account, and (3) the forfeited funds were transferred into WCDA’s forfeiture trust fund account within the Massachusetts Management Accounting and Reporting System (MMARS). In addition, we verified that the amount of forfeited funds were listed in the Microsoft Access forfeiture database.
• WCDA held the forfeited funds from the remaining 14 cases selected for testing. For these cases, we examined forfeiture orders, checks, intake sheets, and deposit slips to determine whether (1) WCDA deposited its portion of the forfeited funds into its Bank of America forfeited funds sweep account, (2) the PD’s portion was accurately disbursed to the appropriate PD, and (3) funds were accounted for on WCDA’s Microsoft Access forfeiture database, maintained by its Fiscal Unit. If the PD’s portion was not disbursed as of the time of our audit, we verified that the funds were accounted for within WCDA’s Microsoft Access forfeiture database.

ICP Updates

To determine whether WCDA updated its ICP to address COVID-19 in accordance with CTR’s “COVID-19 Pandemic Response Internal Controls Guidance,” we inspected the 2020 and 2021 Internal Control Questionnaires that WCDA submitted to CTR. We reviewed the Internal Control Questionnaire questions that addressed COVID-19 preparedness, as well as CTR’s guidance. We also inspected WCDA’s most recent ICP, dated March 2022, to determine whether WCDA made updates to address COVID‑19 in accordance with the guidance.

Cybersecurity Awareness Training

To determine whether WCDA was in compliance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010 regarding cybersecurity awareness training, we interviewed WCDA’s chief information officer and first assistant district attorney to discuss whether WCDA had established a program to ensure that employees received cybersecurity awareness training.

Whenever sampling was used, we applied a nonstatistical sampling approach, and, as a result, we could not project our results to the entire population.

Data Reliability

In 2018 and 2022, the Office of the State Auditor performed a data reliability assessment of MMARS. The assessment focused on reviewing selected system controls, including access controls, cybersecurity awareness, audit and accountability, configuration management, identification and authentication, and personnel security.

To determine the reliability of the list of financial assistance awards that WCDA gave to community programs from the forfeited funds expenditure list, we checked the list for invalid and duplicate records. To test for accuracy, we randomly selected a sample of 10 expenditures from this list and compared the expenditure amounts to copies of the checks and the assistant district attorney’s original memoranda. To test for completeness, we selected a judgmental sample of 10 original memoranda and compared expenditure information on the memoranda to the corresponding expenditures recorded in QuickBooks. Additionally, we compared the aggregate amount of the expenditures on the list to data recorded in MMARS.

To determine the reliability of the list of all other WCDA forfeited fund expenditures, we checked the list for invalid and duplicate records. To test for accuracy, we randomly selected a sample of 20 expenditures from this list and compared the expenditure amounts to copies of the checks and the original memoranda. To test for completeness, we selected a judgmental sample of 20 original check stubs and corresponding invoices and compared expenditure information on the check stubs and invoices to the corresponding expenditures in QuickBooks. Additionally, we compared the aggregate amount of the expenditures on the list to data recorded in MMARS.

To determine the reliability of the list of WCDA’s open confiscated fund cases, we checked the list for invalid and duplicate records. To test for accuracy, we selected a judgmental sample of 20 cases from this list and compared case information to the Request for Asset Forfeiture Forms. To test for completeness, we selected a judgmental sample of 20 Request for Asset Forfeiture Forms from WCDA’s open case files and compared case information to the information recorded in DAMION.

To determine the reliability of the list of forfeited fund cases that were closed during the audit period, we checked the list for invalid and duplicate records. To test for accuracy, we selected a judgmental sample of 20 cases from this list and compared case information to the information recorded in the court orders. To test for completeness, we selected a judgmental sample of 20 court orders from WCDA’s closed case files and compared case information to the information recorded in DAMION.

Based on the data reliability procedures described above, we determined that the data obtained for our audit period were sufficiently reliable for the purposes of our audit work.

3.    WCDA uses DAMION to perform a variety of tasks, including maintaining case, victim, and witness information and tracking court events. DAMION was implemented by the Massachusetts District Attorneys Association for all 11 district attorneys’ offices. Each office can customize the system to some extent to meet its own needs.

Date published:	May 4, 2023