Overview
During our prior audit of BCDA (Audit No. 2018-1261-11J), we found that the agency’s internal control plan had not been updated since 2016. Further, we found that BCDA’s internal control plan did not comply with the Office of the Comptroller of the Commonwealth’s Internal Control Guide. We recommended that BCDA should immediately update its internal control plan to include all the critical components of enterprise risk management. Further, we recommended that BCDA should establish policies and procedures for annually updating its internal control plan, as well as monitoring controls to ensure that these policies and procedures are adhered to.
BCDA did not update its internal control plan as required by the Office of the Comptroller of the Commonwealth’s Internal Control Guide during this report’s audit period either. BCDA’s last published internal control plan was created on April 1, 2016.
An internal control plan identifies objectives and risks and identifies control activities to mitigate risks that may prevent an agency from accomplishing its public mission. Without updating its internal control plan, BCDA may not identify and/or mitigate all risks that could prevent it from accomplishing its objectives.
Authoritative Guidance
The Office of the Comptroller of the Commonwealth’s Internal Control Guide states,
Your department is obligated to review and update your Internal Control Plan on an annual basis, as well as whenever there is a new objective, risk, or management structure. . . .
An internal control plan should have a statement of awareness and compliance with [the Massachusetts General Laws’] Chapter 647 guidelines in addition to the [Committee of Sponsoring Organizations’ eight Enterprise Risk Management Framework] components.
Reasons for Issue
Even though there was an appointed internal control officer during the audit period, in an email dated February 4, 2025, a BCDA official stated,
Prior to taking office . . . [District Attorney] Shugrue requested copies of all policies, but we have been unable to find any documentation or reference to an internal control plan and can only assume the previous administration used the old 2016 Plan for procedural guidance.
Recommendation
BCDA should establish policies and procedures to ensure that its internal control plan is updated annually and when significant changes occur.
Auditee’s Response
When I [Timothy J. Shugrue, District Attorney] assumed Office, I was made aware that there was no written Internal Control Plan in place other than the 2016 version. Completing an Internal Control Plan was a priority. I immediately initiated the process towards completing said plan. This was an extensive task and, upon further investigation, it was uncovered that there was not an active Employee Handbook or Policies and Procedures Manual. These had to be developed in conjunction with the Internal Control Plan as they set out the policies that met the requirements of internal controls and addressed issues unique to the management of the [BCDA]. My Office worked with the Quality Assurance Bureau of the Office of the Comptroller’s Office to guarantee the Plan was following all applicable rules, regulations, and statutes. The final Plan was issued April 1, 2024, to all staff and contains a requirement that it be reviewed on a regular basis for any needed modifications. The Plan must contain the effective date of the Plan and any modifications and be distributed annually to all staff. The Internal Control Officer as well as an Internal Control Committee described in the Plan are responsible for this task.
Auditor’s Reply
Based on its response, BCDA is taking measures to address our concerns regarding this matter. As part of our post-audit review process, we will follow up on this matter in approximately six months.
| Date published: | April 11, 2025 |
|---|