• This page, OCABR Did Not Collect Up to $101,400 in HIC Registration and RCGF Fees and Allowed Employees To Change HIC Application Types Without Documentation and Approval., is   offered by
  • Office of the State Auditor

OCABR Did Not Collect Up to $101,400 in HIC Registration and RCGF Fees and Allowed Employees To Change HIC Application Types Without Documentation and Approval.

Auditors found 676 instances in which the agency allowed contractors to pay the wrong fee.

Table of Contents

Overview

During the audit period, OCABR did not collect up to $101,400 of the HIC registration fees and RCGF fees that HICs incurred. Additionally, OCABR allowed two employees to change HIC application types (from reapplication to renewal) in the HIC registration database, thus reducing the amount charged to HICs, without documentation or approval; as a result, OCABR cannot be certain that fees were assessed to HICs in compliance with its regulations.

In 676 instances during our audit period, OCABR allowed an HIC to pay a renewal fee of $100 even though the fee was paid late (more than 30 days past the expiration date of the current registration), instead of requiring the HIC to pay a reapplication fee ($150) as well as the RCGF fee. The difference between the fees OCABR collected and those it should have collected was $101,400 ($33,800 from HIC registration fees and $67,600 from RCGF fees). Some of these HICs had submitted applications to renew their registrations within the prescribed timeframe, but had not paid their renewal fees within that timeframe. OCABR allowed these HICs to pay the renewal fee late, as indicated below, instead of requiring them to pay the reapplication fee and the RCGF fee.

Late HIC Registrations by Number of Days

Number of Days Late

Number of Transactions

1–14

306

15–30

160

31–365

205

Over 365

5

Total

676

 

During our audit, OCABR officials identified 111 instances, out of the 306 that were 1 to 14 days late, where they believe a payment could have been mailed by an HIC within the required 30 days after expiration, but not received or processed by OCABR until after that period. However, even if we exclude these instances, the agency still allowed 565 contractors to pay only the $100 renewal fee when they should have been charged the reapplication fee and the RCGF fee, resulting in at least $84,750 in lost revenue ($56,500 from RCGF fees and $28,250 from HIC registration fees).

Authoritative Guidance

According to Section 18.02(8)(b) of Title 201 of the Code of Massachusetts Regulations, which covers registration and enforcement of the HIC Program,

An applicant shall submit a renewal application with fees within 30 days of the expiration date of the registration. Failure to submit a renewal application within this time period shall subject the applicant to the submission of an application for a new registration and payment of fees equal to the amount of the initial registration.

Section 10.04 of CTR’s Internal Control Guide from June 2015 states,

Management should divide or segregate key duties and responsibilities among different people to reduce the risk of error, misuse, or fraud. This includes separating the responsibilities for:

  • authorizing transactions,
  • processing and recording them,
  • reviewing the transactions, and
  • handling any related assets or process so that no one individual controls all key aspects of a transaction or event.

In other words, control activities related to authority, custody, and accounting of operations ought to be separated to achieve adequate segregation of duties.

Reasons for Issues

OCABR management told us that they allowed HICs to pay the renewal fee rate when renewing their registrations if they submitted their renewal applications before the expiration dates or within the 30-day grace period. However, these HICs did not pay the fees associated with the applications within the required timeframes.

OCABR management stated that they had given two individuals permission to change HIC application types without documentation or approval each time. OCABR does not have any controls over changes to HIC application types, nor does it have documented policies and procedures to establish such controls.

Recommendations

  1. OCABR should establish controls to ensure that its staff members assess and collect HIC registration fees and RCGF fees in accordance with the correct application types.
  2. OCABR should create policies and procedures regarding the approval process for changes to HIC application types. These policies and procedures should include documentation and approval by a member of management when a staff member changes an HIC application type.

Auditee’s Response

OCABR agrees that there are opportunities for improvement in the administration of the HIC registration process and handling of the RCGF. OCABR has strengthened its policies and made process changes to better manage HIC registration. For example, check scanners were installed to facilitate more timely deposits; management has worked with IT to limit administrator editing access and privileges on the HIC system; we have implemented a review process for editing any transaction; and soon we will run a report to identify transactions processed outside of the time period [prescribed] in the regulations.

OCABR acknowledges that there were instances where HIC staff charged an HIC registrant the $100 renewal fee instead of the $150 reapplication fee and did not require the registrant to pay the RCGF fees. However, the draft audit report incorrectly states that under collection occurred in [676] separate instances. OCABR has determined that the correct fee was, in fact, assessed and collected in some instances that OSA staff counted as under collection. . . .

There were . . . circumstances in which a transaction appeared to include the collection of an incorrect fee amount. However, we subsequently determined that in many cases, the fee was not paid late but rather staff recorded the transaction in the database outside of the 30-day grace period allowed per the regulation. As we previously noted to OSA staff, the HIC program was physically relocated two times during the audit period. Each relocation contributed to a delay in processing timely submitted HIC applications, either because OCABR’s IT systems were not fully operational after the move, or because of delays in receiving forwarded mail. The draft report does state that OCABR identified at least 111 instances where we believe a payment was mailed by an HIC within the required 30 days after expiration, but was not received or processed by OCABR until after the 30 day period.

OCABR acknowledges that the lack of strong recordkeeping during the audit period makes it challenging to demonstrate that certain fees were assessed in compliance with HIC regulations. We are confident that the process and IT enhancements to both HIC registration and RCGF fee collection will prevent any future errors with the collection of HIC registration and RCGF fees. . . .

OCABR has established controls to ensure that its staff members assess and collect HIC registration fees and RCGF fees in accordance with the correct application types delineated in 201 CMR 18.00. OCABR has implemented new protocols to appropriately assign administrative privileges on the HIC system. If a staff member requests to modify an HIC application type or fee amount, that request is made in writing and must be reviewed by the HIC program manager. The manager must approve any modification to the registration and ensure that a request is submitted to IT so that they can make such modification. This new protocol ensures that all requests and modifications are tracked and recorded so staff can confirm that all transactions are processed in accordance with the regulations. . . .

OCABR has established and implemented policies and procedures regarding the approval process for changes to HIC application types. If a staff member requests to modify an HIC application type or fee amount, that request must be in writing and must be reviewed by the HIC program manager. If, after review, the manager approves the modification, the manager would make a request with IT to edit the registration. This is done to ensure that all requests and modifications are recorded and all transactions are processed in accordance with the regulations.

Additionally, there will be a regularly scheduled report to identify transactions processed outside of the [prescribed] time period which senior staff is able to review to ensure that transaction modifications are only being permitted in the correct circumstances (e.g. a complete HIC registration is submitted, but not processed, within the [prescribed] time period).

Auditor’s Reply

In its response, OCABR asserts that there were circumstances where an application appeared to be late and therefore the fee collected was correct. However, any such fees did appear to be incorrect because they were entered late in the system.

In performing our testing in this area, the Office of the State Auditor (OSA) considered all of the explanations and other information provided by OCABR management and reviewed all available documentation to reach our conclusions. Although there may have been circumstances that caused correct fees to appear incorrect to OSA, OCABR cannot substantiate the extent to which such circumstances occurred. OCABR acknowledges that “the lack of strong recordkeeping during the audit period makes it challenging to demonstrate that certain fees were assessed in compliance with HIC regulations.”

Based on its response, OCABR is taking measures to address our recommendations on these issues.

Date published: March 10, 2021

Help Us Improve Mass.gov  with your feedback

Please do not include personal or contact information.
Feedback