Overview
MPTC’s internal control plan (ICP) was not updated annually in accordance with the Office of the Comptroller of the Commonwealth’s (CTR’s) “Internal Control Guide,” published May, 2022, and did not address the effects of COVID-19 on its operations (when its workforce and training were remote, with controlled access to the building and remote functions in the business office) in accordance with the CTR’s “COVID-19 Pandemic Response Internal Controls Guidance,” issued September 30, 2020. MPTC’s ICP has not been updated since 2015.
An ICP identifies objectives and risks and identifies control activities to mitigate risks that might prevent an agency from accomplishing its objectives in service to the public. Without updating its ICP, MPTC may not identify and/or mitigate all the risks, including those that resulted from the pandemic.
Authoritative Guidance
CTR’s Internal Control Guide, published May 2022 states, “Your department is obligated to review and update your Internal Control Plan on an annual basis, as well as whenever there is a new objective, risk, or management structure.”
CTR’s “COVID-19 Pandemic Response Internal Controls Guidance,” dated September 30, 2020, states,
Department internal control plans must be based on risk assessments and updated annually, or when significant changes occur. Because the COVID-19 Pandemic has affected all departments, The Comptroller, in consultation with the State Auditor’s Office, is providing two options for updating internal controls.
- If the impact to your department is such that it can be reflected in your Internal Control Plan (ICP), then update the ICP as you would for any other mid-year changes.
- Departments experiencing a significant impact, and requiring the accumulation of substantial documentation (e.g. changes to business processes, requirements of federal and state-specific laws or guidance, new funds or new programs), can draft a separate COVID-19 Pandemic Response Plan Appendix to the ICP as an organized set (hard or soft copies) of emails, documents, risk assessments, policies, and procedures.
Reasons for Issue
MPTC’s executive director stated that MPTC experienced rapid growth as a result of the 2018 and 2020 reforms acts, which required management to prioritize curriculum development and delivery over other organizational duties, including ICP updates during the audit period.
MPTC could not explain the reason it did not update its ICP during 2016 through 2019.
MPTC did not have policies and procedures, including a monitoring component, to ensure that its ICP is updated annually and when significant changes occurred.
Recommendation
MPTC should establish policies and procedures, including a monitoring component, to ensure that its ICP is updated annually and when significant changes occur.
Auditee’s Response
The MPTC has updated its Internal Control Plan (ICP) and appreciates the support of both the Office of the State Auditor and the Office of the Comptroller (CTR) throughout this process. Further, the MPTC will establish a policy and procedure, which will include a monitoring component, to ensure that its ICP is updated annually and when significant changes occur. As recommended by CTR prior to drafting an updated ICP, MPTC leadership, including all Fiscal and Human Resources team members, completed CTR trainings on Fraud Management and Mitigation, and Risk Management and Internal Control. The MPTC’s Fiscal and Human Resources teams also completed additional CTR courses such as PowerDMS, Websites Overview, Solution Desk, and State Finance Fundamentals. Subsequently, the MPTC’s leadership, including all Fiscal and Human Resources team members, then completed a CTR live Internal Control Plan Workshop, which was designed for our Agency. CTR then confirmed that the MPTC had completed all required trainings it needed to effectively update its ICP, which also included performing a detailed risk analysis of the Agency. The ICP was prepared in accordance with the Office of the Comptroller’s Internal Control Guide. The Internal Control Guide is based on the Committee of Sponsoring Organizations’ (COSO) Enterprise Risk Management Framework (ERM) with its eight components and seventeen principles. The guide incorporates the Standards for Internal Control in the Federal Government’s (known as the Green Book) adaption of COSO’s Internal Control — Integrated Framework (2013).
Auditor’s Reply
Based on its response, we commend MPTC for taking measures to address our concerns regarding this matter.
| Date published: | December 26, 2024 |
|---|