The MBTA has not developed an internal control plan. In addition, the MBTA could not demonstrate that it had conducted a department-wide risk assessment which would be used to identify potential risks regarding all aspects of its business operations (financial, operational, and compliance activities) and to design and implement internal controls to mitigate such risks.
Without a sufficiently developed internal control plan, based on a department-wide risk assessment, the MBTA is limited in its ability to identify vulnerabilities, which could prevent it from achieving organizational goals and objectives. This also exposes the MBTA to heightened risks in its operations.
Authoritative Guidance
According to Chapter 647 of the Acts of 1989, every state agency must maintain an internal control plan, review it annually, and update it as necessary.
Reasons for Condition
We asked the MBTA why the agency does not have an internal control plan. In an email on March 1, 2024, MBTA’s senior counsel of regulatory compliance stated,
The MBTA has ensured it has internal controls by issuing its own fully independent audited financial statements, having [System and Organization Control] reports for its financials and materials information system, and following its applicable internal policies and procedures that are reviewed and accepted by our external independent auditors.
Recommendations
- The MBTA should develop an internal control plan based on a current department-wide risk assessment that includes all aspects of its business activities.
- After completing the internal control plan, the MBTA should ensure that the internal control plan is communicated to all employees, used within its operations, and reviewed and updated at least annually.
Auditee’s Response
The MBTA does not disagree that it does not have an authority wide internal control plan. . . . The MBTA disagrees with the SAO’s claim Chapter 647 of the Acts of 1989 applies to the MBTA as the MBTA is not a state agency. The MBTA was formed under [Massachusetts General Laws, Chapter] 161A and is considered “a body politic and corporate and a political subdivision of the commonwealth.” See Daveiga v. Bos. Pub. Health Comm’n, 449 Mass. 434, 451 (2007). Specifically, there is no inclusion of the MBTA of the executive branch, which may cause it to be considered an “agency.” The MBTA is typically referred to as an “authority” or “quasi-public” entity as opposed to a “state agency” and is not specifically included in Chapter 647 of the Acts of 1989. Courts have found that the MBTA is a public entity and a political subdivision, but not a state agency, which applies to the application of the Commonwealth’s laws and regulations. For example, the MBTA is not considered a “common carrier” for purposes of certain advertising regulations. See Massachusetts Bay Transp. Authority v. City of Somerville, 451 Mass. 80, 86 (2008). Additionally, the MBTA’s retirement board is not subject to the conflict-of-interest law applicable to state agencies. See Massachusetts Bay Transp. Authority Retirement Bd. v. State Ethics Com’n, 414 Mass. 582, 593 (1993).
Auditor’s Reply
We recognize that the MBTA is a quasi-public agency and, therefore, is not required to comply with Chapter 647 of the Acts of 1989. However, we believe that a properly documented internal control plan is essential in any business operation, as it helps identify areas of financial and operational risk that should be addressed in an agency’s policies and procedures. As noted above, without a sufficiently developed internal control plan, based on a department-wide risk assessment, the MBTA is limited in its ability to identify vulnerabilities which could prevent it from achieving organizational goals and objectives, and exposes itself to heightened risks in its operations. Although Chapter 647 of the Acts of 1989 does not apply to the MBTA, the MBTA should voluntarily adopt its provisions, as we consider them a best practice for internal controls in state agencies. We urge the MBTA to fully implement our recommendations.
| Date published: | March 4, 2025 |
|---|