Overview
The Massachusetts School Building Authority has not updated its internal control plan since 2018. This issue was also identified and discussed during our previous audit (Audit No. 2022-1461-3A); however, it has still not yet been resolved.
Without an up-to-date internal control plan, MSBA may be limited in its ability to identify vulnerabilities, which could prevent it from achieving organizational goals and objectives. This also exposes MSBA to heightened risks in its operations.
Authoritative Guidance
According to Chapter 647 of the Acts of 1989, every state agency must maintain an internal control plan, review it annually, and update it as necessary.
In addition, the Office of the Comptroller of the Commonwealth’s Internal Control Guide states, “Your department is obligated to review and update your Internal Control Plan on an annual basis, as well as whenever there is a new objective, risk, or management structure.”
Although MSBA is not required to comply with Chapter 647 of the Acts of 1989 or follow the Office of the Comptroller of the Commonwealth’s standards, since it is a quasi-public agency, we consider them best practices.
Reasons for Issue
We requested clarification from MSBA regarding the absence of an updated internal control plan. According to MSBA officials, its internal control plan has not been updated since 2018 due to personnel changes and the need to revise practices following the onset of the COVID-19 pandemic in March 2020. With the appointment of a new chief financial officer at the end of 2024, the process of updating its internal control plan has begun, with the goal of completing the 2025 update by year-end.
Recommendations
- MSBA should review and update its internal control plan whenever significant changes occur in objectives, risks, or management structure, but at least annually.
- After updating its internal control plan, MSBA should ensure that the internal control plan is communicated to all employees and used within its operations.
Auditee’s Response
As noted by the Office of the State Auditor, Chapter 647 of the Acts of 1989 does not apply to the MSBA as we are a quasi-governmental agency. However, we do agree that regular review and update is best practice. . . The MSBA appreciates the recommendations made by the Office of the State Auditor and is underway with its review of the Internal Control Plan. Once complete, we will ensure that it is communicated to all employees and used within MSBA’s operations.
Auditor’s Reply
Based on its response, MSBA is taking measures to address our concerns regarding this matter. As part of our post-audit review process, we will follow up on this matter in approximately six months.
| Date published: | December 24, 2025 |
|---|