Overview
CPCS’s internal control plan (ICP) was not updated with a 2019 coronavirus (COVID-19) component as required by the Office of the Comptroller of the Commonwealth’s (CTR’s) “COVID-19 Pandemic Response Internal Controls Guidance,” issued September 30, 2020. CPCS’s ICP was last updated in June 2020.
The absence of an up-to-date ICP may hinder CPCS from identifying vulnerabilities that could prevent it from achieving its mission to provide legal assistance to those in need and ensure equal access to legal representation to Massachusetts residents.
Authoritative Guidance
CTR’s “COVID-19 Pandemic Response Internal Controls Guidance,” dated September 30, 2020, states,
Department internal control plans must be based on risk assessments and updated annually, or when significant changes occur. Because the COVID-19 Pandemic has affected all departments, The Comptroller, in consultation with the State Auditor’s Office, is providing two options for updating internal controls.
- If the impact to your department is such that it can be reflected in your Internal Control Plan (ICP), then update the ICP as you would for any other mid-year changes.
- Departments experiencing a significant impact, and requiring the accumulation of Substantial documentation (e.g. changes to business processes, requirements of federal and state-specific laws or guidance, new funds or new programs), can draft a separate COVID-19 Pandemic Response Plan Appendix to the ICP as an organized set (hard or soft copies) of emails, documents, risk assessments, policies, and procedures.
CTR’s “Internal Control Guide,” revised June 25, 2015, states, “Accordingly, departments are obligated to revise their ICPs whenever significant changes occur in objectives, risks, management structure, program scope, etc. At the very least, the ICP must be reviewed and updated annually.”
Reasons for Issue
CPCS did not have policies and procedures to ensure that its ICP is updated annually and when significant changes occurred.
Recommendation
CPCS should establish policies and procedures to ensure that its ICP is updated annually and when significant changes occur.
Auditee’s Response
CPCS has updated the agency’s Internal Control Plan. Further, CPCS has established systems, policies, and procedures to ensure that the agency’s ICP is updated annually and when significant changes occur.
The most recent update to the Internal Control Plan was developed by CPCS management and was completed last year after undertaking a detailed risk assessment. Management believes internal controls are fundamental to achieving the mission, goals, and objectives of the agency and to mitigate potential risks. Further, CPCS management believes internal controls are an integral part of the agency's values and essential to successful program and organizational operations. The latest version of the ICP has been presented to and reviewed by our governing board.
In specific response to the COVID-19 Pandemic Emergency, the Chief Counsel designated the Director of Administration and Operations as the CPCS COVID-19 Response leader in March 2020. The Director oversaw all operational responses to COVID, delivered policy and other guidance via thirty-three (33) emails to staff, held conference calls with agency managers and directors and ensured that staff was regularly updated regarding operational and service changes. The Director also formed a committee of staff from various positions across the Commonwealth to create, review and recommend COVID policies and procedures which maintained the health and safety of staff while serving our clients and fulfilling our agency mission.
For example, CPCS quickly made plans for necessary office coverage at our 20 office locations, adopted systems to ensure that we maintained contact with incarcerated and hospitalized clients by telephone and mail, and instituted virtual conferences. Each office was required to create a reopening plan. All staff were trained on CPCS COVID policies and procedures. When the Governor announced reopening requirements, the agency ensured that COVID Reopening Policies and Procedures complied with the requirements specific to the type of business conducted in each office. As the Governor’s reopening requirements were updated, the agency’s policies and procedures were likewise updated.
Further, senior staff, including the Chief Counsel, Director of Administration and Operations, General Counsel, Human Resources, IT, and CFO, held virtual town halls with agency managers and staff to address agency policies and procedures during the pandemic to ensure the continued zealous representation of clients as well as staff support.
Throughout the pandemic, CPCS continued to zealously represent clients, supported staff, and met our fiduciary obligations to the Commonwealth as well as our financial obligation to ensure timely payments to private attorneys and vendors.
Auditor’s Reply
Based on its response, CPCS has taken measures to address our concerns in this area.
| Date published: | June 9, 2023 |
|---|