• This page, Other Matters: The Division of Professional Licensure Should Improve Its Administration of Criminal Offender Record Information and Sex Offender Record Information Check Processes for Licensees and License Applicants., is   offered by
  • Office of the State Auditor

Other Matters: The Division of Professional Licensure Should Improve Its Administration of Criminal Offender Record Information and Sex Offender Record Information Check Processes for Licensees and License Applicants.

OSA identified several issues with how the Division of Professional Licensure (DPL) administered its background check processes for license applicants and licensees.

Table of Contents


As previously noted, the Office of the State Auditor (OSA) could not apply all the procedures we considered necessary to reach a conclusion on our audit objective; however, while performing our audit work, OSA identified several issues with how the Division of Professional Licensure (DPL) administered its background check processes for license applicants and licensees. We believe these issues warrant management’s attention.

DPL Should Establish Internal Controls Over Its Background Check Processes.

DPL has not established adequate internal controls (i.e., policies and procedures) over any aspect of its background check processes. The following are examples of activities in DPL’s background check processes for which there are no documented policies and procedures:

  • how to enter/document Criminal Offender Record Information (CORI) and Sex Offender Record Information (SORI) results in Accela and MyLicense Office (MLO) and who is responsible for doing so
  • how to monitor and ensure the accuracy and completeness of the information entered in Accela and MLO and any changes made to the information once it has been entered
  • what process should be followed for collecting SORI data to be sent to the Sex Offender Registry Board (SORB) and retrieving data sent from SORB to DPL
  • how to monitor and manage CORI and SORI results for internal reviews and signoffs.

We believe that to ensure that its background check processes are conducted consistently and documented properly, DPL management should immediately develop and implement policies and procedures for those processes.

Auditee’s Response

DPL has taken a number of steps to establish internal controls over its background check process in order [to] address the recommendations in the draft audit report; specifically, these controls govern how information should be documented regarding CORI and SORI checks; how information should be transmitted to both the Department of Criminal Justice Information Services (DCJIS) and SORB; and, program integrity checks to ensure the information and documentation is being done correctly. Finally, DPL will be centralizing both CORI and SORI checks into one background check unit, which will allow for monitoring and management of CORI and SORI information.

First, even prior to the start of the audit DPL had committed to hire a CORI counsel to lead and coordinate DPL’s CORI processes across the agency. The position was posted in August 2020 and a CORI counsel was hired in December 2020. In this position, the CORI counsel has reviewed the policies in place for each DPL board that conducts a background check, to confirm those policies contain what is required by law and that they provide applicants and licensees with all necessary information to understand how they are being evaluated. In addition, the CORI Counsel is drafting CORI policies for [Office of Public Safety and Inspections, or OPSI] boards that will allow those entities to begin conducting CORI background checks prior to the issuance of a license. Such CORI policies must be adopted by the OPSI boards, bureaus, and other governing bodies that set licensing standards before they become effective.

Second, DPL has created and implemented standard operating procedures (“SOP”) for conducting both CORI checks and SORI checks. The CORI SOP puts into writing what was already happening in practice, namely: what information is needed and how it is to be transmitted using the correct format; follow-up procedures when more information is required of an applicant based on a CORI check; how a CORI should be processed; and the proper safeguarding and destruction of CORI information consistent with applicable statutes. In addition, the CORI SOP establishes new procedures to ensure program integrity, including creation of new reports that will allow DPL managers to verify that licensing databases are timely and properly updated to show that a CORI check was conducted.

As part of the CORI SOP, on a quarterly basis, the CORI Counsel will audit a sample of licensees using data from Accela (the licensing database for the 29 boards) and non-Accela systems (OPSI licensing databases), along with reports from Department of Criminal Justice Information Services to ensure compliance with all stated procedures. The process will identify any areas of concern and provide opportunities for corrective action at quarterly intervals. The random sample from the Accela and non-Accela population will be checked against the completed CORI requests to ensure that the record was requested and provided. All reports will be in writing, so that there is a record of the escalation, and followed-up with an in-person communication.

Third, and as mentioned above, DPL has created a SORI SOP, which details the different roles and responsibilities in DPL regarding supervision of the SORI processes, collection of data from boards, submission of the SORI information, communication of the SORI results to relevant stakeholders, and management of program integrity measures and records related to the SORI Check. This follows and builds on the [interdepartmental services agreement] between DPL and the Sex Offender Registry Board that we signed in June 2020 that formalized the sharing of data between the two agencies. In order to maintain integrity and consistency with the SORI process, the SOP has established two confirmatory tests to be conducted on a quarterly basis. This first test will consist of a review of records to confirm that the SOP has been followed by DPL staff. The second test will determine whether current protocols correctly identify registered sex offenders by submitting a mock SORB check request containing information which should result in a SORI match.

Fourth, DPL has been working with both of our licensing database vendors to modernize the tools available to DPL and the public they serve. Through our partnership with the Executive Office of Technology Services and Security, we are planning and executing three major upgrades to the Accela System. In addition, we are planning a health check analysis to assess gaps in our business and technology processes. We have been working with System Automation for the last year to upgrade our services.

Fifth, and finally, DPL is also in the process of [staffing] up a background check unit to be run by a newly hired Director of Background Checks. This position has been posted and DPL is actively reviewing candidates for this position. As noted above in the response to Recommendation No. 1a, DPL has already hired a CORI Counsel to support this work. Once established, the background check unit will centralize the CORI and SORI checks and establish one point of contact for the entire agency when CORI and SORI checks are submitted. The background check unit will review positive CORI or SORI hits against a particular board’s criminal background check policies to ensure that applicants and licensees are being held to the same standard. This review will be communicated to that particular board for any required follow-up. The background check unit will update the licensing databases so there is a notation in the system that a CORI check has been conducted, and to ensure the consistency in the documentation of this information in those databases.

DPL appreciates the recommendations contained in the draft audit report regarding internal controls over background checks, which are in line with the changes the agency was working on before the audit began. These changes have formalized the collection and dissemination of data for both CORI and SORI and centralized these processes so that program integrity—including self-auditing—can be better managed.

DPL Should Assist the Office of Public Safety and Inspections in Assessing Whether Its Licensees Sho

The intent of the CORI law is to protect populations from abuse. CORI checks are routinely required for candidates applying for many types of jobs, particularly ones where they could be expected to provide services to, or otherwise come into contact with, children, elderly people, or people with disabilities while unsupervised. As previously noted, the Office of Public Safety and Inspections (OPSI) only requires CORI checks of applicants for 9 of its 85 license types.

OSA believes that to better ensure public safety, DPL should create guidance for all OPSI boards and commissions to assist them in assessing the risk their licensees pose to vulnerable populations and creating standards for CORI checks.

Auditee’s Response

Similar to other boards within DPL, applicants for an OPSI license are typically not required by law to have a CORI or SORI check prior to being issued a license. Individual boards may decide that such checks should be part of their application review, but those decisions are made at the board level since they enforce the standards for licensing in their respective professions. DPL does see value in CORI and SORI checks for OPSI licensees, and we will recommend that the OPSI boards and bureaus begin conducting those checks once the background unit is in place.

DPL Should Consider Performing Background Checks of Licensees When They Renew Their Licenses.

Once DPL has performed an initial background (CORI and/or SORI) check of license applicants, it is not required by state laws, regulations, or its own internal policies to perform subsequent CORI or SORI checks of licensees. When licensees want to renew their licenses, they simply have to pay license renewal fees and provide required documents. As previously discussed, DPL does conduct periodic SORI checks for all licensees of its 29 boards, but not for any licensees of OPSI. In contrast, many state agencies conduct periodic background checks for individuals they employ or license. For example, the Department of Elementary and Secondary Education conducts CORI and SORI checks of educators when they renew their licenses. OSA believes that to better ensure public safety, DPL should consider performing periodic background checks of licensees when they renew their licenses.

Auditee’s Response

Currently, there is not an across-the-board statutory requirement to conduct CORI checks on 580,000 individuals who are eligible to renew their license. At this time, DPL does not plan to implement such a process due to significant logistical and technological barriers. For example, if DPL staff were to run CORI checks on the nearly 180,000 to 200,000 licensees who renew each year, that would represent a nearly 500% increase in the number of CORI’s run by the Agency each year, a process currently done manually, without the benefit of an automated [information technology] interface. Further, most DPL licenses are valid for two years; the permission forms received from license applicants to facilitate CORI at initial application are only valid for one year. To run a CORI at renewal for the population of licensees eligible to renew each year, DPL would need to request permission forms from each licensee, further complicating and lengthening the license renewal process. This may prevent otherwise qualified licensees from timely renewing their licenses and potentially put them out of work. Finally, the Agency would need to hire a significant number of additional specially trained staff to process CORI permission forms, run CORI checks, and review those results.

In lieu of running CORI at renewal, DPL instead plans to continue its current practice of requiring licensees to disclose, through an attestation process already incorporated into the renewal process, that the licensee has reported all convictions to the board that issues their license. DPL’s experience with this process has been that many licensees do inform the board at renewal of a recent criminal conviction, which allows the board to conduct necessary follow-up regarding that person’s suitability to hold a license. However, to further supplement this process, DPL will institute a new practice of auditing a sample of licensees who renew each month. All licensees will be informed during the renewal process that DPL may check their attestation to ensure it is accurate, and that failure to disclose a criminal conviction will be independent grounds for discipline, including the revocation of the license.

Finally, as previously noted, DPL does conduct a monthly SORI check on the majority of its licensees and it is working to expand this to include the entire licensee population. This process ensures that DPL boards become aware of any licensee convicted of some of the most serious of crimes, as soon as that information is available. This allows DPL boards promptly and proactively to take action against licensees who truly pose a serious risk to the safety, health, and well-being of consumers.

DPL Needs To Ensure That License Applicants Are Not Issued Licenses Until DPL Has Obtained a Satisfa

During our walkthrough of DPL’s Board of Registration of Cosmetology and Barbering (BRCB) background check process, we found that BRCB used a contracted vendor to administer its licensing exams, issue licenses, and obtain CORI authorization forms from applicants. During our audit, we analyzed the licensing and CORI check data about BRCB’s vendor and found that during our audit period, this vendor appeared to have issued 9,155 licenses before the applicants had passed CORI checks. As previously mentioned, during our audit period, nine of DPL’s boards used a contracted vendor for various services, such as preparing application packages, administering exams, obtaining CORI authorization forms, and issuing licenses. However, DPL does not have a process that prohibits contracted vendors from issuing licenses before applicants pass CORI checks conducted by DPL. This control deficiency increases the risk of a vendor issuing a license to someone who may have a criminal record that should preclude him/her from obtaining the license.

DPL should establish policies and procedures that standardize the background check process for all of its boards and agencies that use vendors to perform their licensing-related activities so that no vendor can issue a license to an applicant before the applicant has passed a CORI check.

Auditee’s Response

DPL has acknowledged that some applicants were issued licenses in the cosmetology profession by a DPL vendor before a criminal background check was conducted. DPL has worked with the vendor to change this process so that those applicants are now required to undergo a CORI check prior to the issuance of their license.

Date published: September 15, 2021

Help Us Improve Mass.gov  with your feedback

Please do not include personal or contact information.