Overview
MLAC’s internal control plan (ICP) was not updated with a COVID-19 component as required by the Office of the Comptroller of the Commonwealth’s (CTR’s) “COVID-19 Pandemic Response Internal Controls Guidance,” issued September 30, 2020. MLAC’S ICP was last updated in 2017, before the start of the COVID-19 pandemic.
The absence of an up-to-date ICP may hinder MLAC’s effective and efficient achievement of its mission and objectives.
Authoritative Guidance
CTR’s “COVID-19 Pandemic Response Internal Controls Guidance” states,
Department internal control plans must be based on risk assessments and updated annually, or when significant changes occur. Because the COVID-19 Pandemic has affected all departments, The Comptroller, in consultation with the State Auditor’s Office, is providing two options for updating internal controls.
- If the impact to your department is such that it can be reflected in your Internal Control Plan (ICP), then update the ICP as you would for any other mid-year changes.
- Departments experiencing a significant impact, and requiring the accumulation of substantial documentation (e.g. changes to business processes, requirements of federal and state-specific laws or guidance, new funds or new programs), can draft a separate COVID-19 Pandemic Response Plan Appendix to the ICP as an organized set (hard or soft copies) of emails, documents, risk assessments, policies, and procedures.
Reasons for Issue
MLAC did not have policies and procedures, including a monitoring component, to ensure that its ICP was updated when significant changes occurred.
Recommendation
MLAC should establish policies and procedures, including a monitoring component, to ensure that its ICP is updated when significant changes occur.
Auditee’s Response
MLAC was not aware of the Office of Comptroller’s COVID-19 Pandemic Response Internal Controls Guidance, issued on September 30, 2020, and did not receive a copy. MLAC has been informed that the Comptroller’s Office sent an email regarding the Pandemic Response Internal Controls Guidance and sent quarterly updates to state agencies when COVID started regarding the need to update ICPs. MLAC did not receive the email or the quarterly updates from the Comptroller’s Office.
Despite not receiving the COVID-19 Pandemic Response Internal Controls Guidance, MLAC created a COVID-19 team responsible for reviewing state and CDC guidelines and updating MLAC’s safety guidelines and work practices as needed. MLAC implemented COVID-19 safety protocols and guidelines, remote work policies, a temporary optional return to office policy, and a return to office plan. And MLAC tracked COVID-19 related awards and expenditures.
MLAC utilizes its internal control plan, financial management and accounting procedures manual and updated financial accounting procedures provided to our auditors each year as its overall control policies. Changes made to MLAC’s internal control plan and procedures, including those responsive to the COVID-19 pandemic were made and documented, but not incorporated into MLAC’s ICP document.
MLAC is a quasi-public agency. Guidance to MLAC by the Office of the Comptroller is needed to determine why MLAC did not receive the COVID-19 Pandemic Response Internal Controls Guidance. Additional guidance is needed to determine to what extent MLAC is expected to conform to policies issued by the Comptroller’s Office or other state office’s policies and procedures. as a quasi-public agency.
Moving forward MLAC will update its internal control plan annually to reflect any changes made to internal control procedures and note when the internal control plan was updated.
Auditor’s Reply
Based on its response, MLAC is taking measures to address our concerns on this matter.
| Date published: | June 16, 2023 |
|---|