Overview
We determined that CCC lacked the ability to identify when license fees had been paid more than once. In our review of transaction data, we identified multiple identical payments (22 instances, totaling $3,445 in overpayments) made by licensees for the same fee. CCC had not previously detected these overpayments.
Additionally, while performing testing on the larger population of fees identified during the audit period, we found that CCC was comingling revenue codes, leading to multiple revenue sources being classified under one unique identifier. For example, revenue code 638 contained 21 revenue source codes, which were found to include a mix of different fee types.19
The failure to implement adequate financial controls resulted in several risks and inefficiencies, including the following:
Financial Misstatements and Reporting Inaccuracies
- The commingling of revenue codes undermines accurate revenue tracking, which can distort financial reports, impact budgetary decision-making, and lead to noncompliance with state financial reporting requirements.
Erosion of Public and Stakeholder Trust
- The inability to identify and prevent duplicate payments exposes licensees to potential financial harm, raising concerns about CCC’s credibility, financial integrity, and regulatory oversight capacity.
- Without proper revenue categorization and duplicate payment detection, there is an increased risk of undetected financial mismanagement, revenue loss, and/or fraud.
Operational Inefficiencies
- The absence of systematic safeguards delays the resolution of discrepancies, which may delay financial reconciliations and impair CCC’s overall fiscal management.
Authoritative Guidance
Regarding the commingling of revenue codes, CTR establishes accounting rules and guidelines for all state agencies, including the proper classification and tracking of revenue. CTR’s Revenue Handbook states the following:
IV. REVENUE SOURCE CODE DEFINITIONS/DESCRIPTIONS
Revenue Source Codes are created by the Office of the Comptroller (CTR) for use in collecting, identifying, tracking and reporting revenue received by the Commonwealth. . . . Some Revenue Source Codes are broad and are used by more than one department; others are created and used for a specific purpose.
If a Department thinks it needs to create a new Revenue Source Code, it should contact CTR’s General Accounting Bureau. Departments must provide the legislation authorizing the revenue to be collected, type of revenue and indicate whether the revenue is to be linked to a specific account number, etc.
Regarding the inability to identify the double charging of fees, CTR’s “Cash Recognition and Reconciliation Policy” states the following:
Reconciliation of Cash Receipts
Daily system assurance must be performed by departments to ensure that there is a matching deposit for each cash transaction. This process involves comparing the results from all sources that produce or contain payments and deposit information, and ensuring that they match. These information sources should include any delegated system reports, all relevant MMARS tables and/or reports, and Information Warehouse reports. Departments needing assistance in establishing system assurance procedures should contact CTR’s Revenue Bureau.
Reasons for Issue
CCC lacks automated system controls or alerts within MassCIP to identify double payments. No reconciliation process was in place to detect or prevent duplicate transactions during the audit period.
CCC has not implemented proper accounting procedures to ensure that each revenue source is assigned a distinct classification.
Recommendations
- CCC should implement automated system controls and validation procedures to monitor and prevent duplicate payments.
- CCC should assign unique revenue codes to different revenue types.
- CCC should perform regular reconciliations to detect or prevent duplicate transactions.
- Until CCC implements a reliable system that detects or prevents duplicate transactions, CCC should make licensees aware of potential duplicate fees so that they may safeguard against improper charges by CCC.
Auditee’s Response
CCC’s Recommendation 1 response was as follows:
The Commission has a contract with a payment processor to process credit card payments. Licensees are directed to the payment page from the third-party software to enter their credit card information to initiate payment for their license or fee. In random incidents it appears the payments were being resubmitted by the processor multiple time before timing out, resulting in duplicate charges to the payee’s credit card. The payment processing service provider has implemented an update to correct the issue of duplicates transactions processing during the time-out period. The CCC has also added a reconciliation process to catch payments made that are not recorded in the internal licensing software. This reconciliation process will identify duplicate payments if this “glitch” with the payment processor occurs again.
CCC’s Recommendation 2 response was as follows:
The CCC uses unique [external cash receipt table (ECRT)] codes for each fee type, which directs electronic fee payments to the specific revenue / transaction codes in the State’s Accounting System (MMARS) for all electronic payments. These codes have always been used to identify specific fees on electronic payments. These codes were added to manual payment transactions (i.e. checks) at the beginning of [fiscal year] 2025. Reporting by fee type is completed through ECRT reports. Additional Revenue Source codes were also added in [fiscal year] 2025 and remapping of fees has been completed—currently, 14 separate application fees exist with their own separate ECRT codes that are then directed into one (1) Revenue Code for Applications Fees, but the reporting can be broken out by revenue code or ECRT, as needed. This process improvement is an approved method of reporting revenue, per the Office of the Comptroller.
CCC’s Recommendation 3 response was as follows:
The Finance Department began receiving weekly reports from MassCIP and [Medical Use of Marijuana Program Online System] in March 2025 which are now reviewed and reconciled to payments received. See further information on duplicate payments in response to recommendation 1 of FINDING 7.
CCC’s Recommendation 4 response was as follows:
Finance conducts daily manual checks as a short-term control. Since this process was implemented in April 2025, no duplicate payments have been identified. Long-term system improvements will require investment in the Commission’s [information technology] Infrastructure, refenced in response to FINDING 1, Recommendation 1.
Auditor’s Reply
- CCC stated in its response that its payment processing service provider has implemented an update to prevent duplicate transactions from occurring. Additionally, CCC stated that a reconciliation process has been added to catch payments that are not recorded in its internal licensing software. As part of our post-audit review process, we will follow up on this matter in approximately six months.
- CCC stated in its response that, starting at the beginning of fiscal year 2025, it used unique external cash receipt table codes for each fee type. We are happy to see that CCC has started using unique revenue codes after this issue was identified by our audit. As part of our post-audit review process, we will follow up on this matter in approximately six months.
- CCC stated in its response that its Finance Department began reviewing and reconciling reports from its licensing system in March 2025. We are happy to see that CCC has started reviewing and reconciling payment information after this issue was identified by our audit. As part of our post-audit review process, we will follow up on this matter in approximately six months.
- CCC stated in its response that, starting April 2025, the CCC Finance Department conducts daily manual checks to determine whether duplicate payments have occurred. As part of our post-audit review process, we will follow up on this matter in approximately six months.
| Date published: | August 14, 2025 |
|---|