BHCC Did Not Update Its Internal Control Plan To Address the Effects of COVID-19 on Its Operations.

An ICP identifies objectives and risks and identifies control activities to mitigate risks that will prevent an agency from accomplishing its objectives. Without updating its ICP, BHCC may not identify and/or mitigate all the risks triggered by the pandemic.

Overview

BHCC did not make additions or adjustments to its internal control plan (ICP) to address the effect of COVID-19 on its operations. Specifically, BHCC did not update the following areas: preparing for the current and long-term effects of the COVID-19 pandemic and properly accounting for COVID-19 funding and related expenditures.

An ICP identifies objectives and risks and identifies control activities to mitigate risks that will prevent an agency from accomplishing its objectives. Without updating its ICP, BHCC may not identify and/or mitigate all the risks triggered by the pandemic.

On March 13, 2020, the President declared a national emergency due to COVID-19. Following this declaration, BHCC students, faculty members, and staff members converted to remote learning and work environments. However, BHCC’s ICP did not include instructions on how to address these significant changes to business processes and internal controls to mitigate the risks that resulted from the pandemic.

Authoritative Guidance

The Office of the Comptroller of the Commonwealth’s (CTR’s) “COVID-19 Pandemic Response Internal Controls Guidance” states,

Department internal control plans must be based on risk assessments and updated annually, or when significant changes occur. Because the COVID-19 Pandemic has affected all departments, The Comptroller, in consultation with the State Auditor’s Office, is providing two options for updating internal controls.

1. If the impact to your department is such that it can be reflected in your Internal Control Plan (ICP), then update the ICP as you would for any other mid-year changes.
2. Departments experiencing a significant impact, and requiring the accumulation of substantial documentation (e.g. changes to business processes, requirements of federal and state-specific laws or guidance, new funds or new programs), can draft a separate COVID-19 Pandemic Response Plan Appendix to the ICP as an organized set (hard or soft copies) of emails, documents, risk assessments, policies, and procedures.

Reasons for Issue

BHCC officials told us that the designated internal control officer (the vice president of administration and finance, who also coordinates with CTR) could not locate CTR’s email that included the above guidance and that therefore guidance was missed during a critical time in the pandemic.

Recommendations

1. BHCC should update its ICP whenever significant changes occur.
2. BHCC should determine whether its designated internal control officer is the correct staff member to receive and respond to internal control communication from CTR.

Auditee’s Response

The initial email from the Comptroller’s Office was sent to all Chief Financial Officers on May 17, 2020, along with the COVID-19 Guidance for Updating Internal Control Plans.

After several unsuccessful searches, this email could not be located. The College transitioned to remote operations in mid-March 2020. By May the executive team’s focus remained on addressing the overwhelming number of issues arising from the transition. Consequently, emails piled up in inboxes while the executive team was dealing with the emergency. The email may have been deleted inadvertently. It was also noted that a follow-up email was not sent by the Comptroller’s Office on this subject. It would have been helpful to receive another prompt.

Although the above-mentioned request and the attached guidance were not received in May 2020, the College leadership took and continues to take steps to identify risks, to put adequate controls in place to assess the impact of the pandemic, to reduce disruptions, to mitigate risks, and to develop safety protocols.

The following actions are taken to improve this process:

• A COVID-19 Pandemic Response Plan Appendix to the Internal Control Plan is being drafted to complete the requirement as described in the Internal Control Guidance.
• We have determined the current staff member is the correct Internal Control Officer to receive and respond to communications.

Auditor’s Reply

Based on the response above, BHCC is taking measures to address our concerns.

Date published:	June 13, 2022