Overview
SOC did not update its internal control plan (ICP) with a 2019 Coronavirus (COVID-19) Response Plan Appendix. During the audit period, SOC did create a separate “COVID-19 Response Plan,” but it did not incorporate it into the ICP. Additionally, SOC’s ICP was last updated in 2019 before the start of the COVID-19 pandemic.
By not updating its ICP with a COVID-19 Pandemic Response Plan Appendix, SOC could be vulnerable to not effectively and efficiently achieving its mission and objectives.
Authoritative Guidance
The Office of the Comptroller of the Commonwealth’s (CTR’s) “COVID-19 Pandemic Response Internal Controls Guidance,” issued September 30, 2020, states,
Department internal control plans must be based on risk assessments and updated annually, or when significant changes occur. Because the COVID-19 Pandemic has affected all departments, The Comptroller, in consultation with the State Auditor's Office, is providing two options for updating internal controls.
- If the impact to your department is such that it can be reflected in your Internal Control Plan (ICP), then update the ICP as you would for any other mid-year changes.
- Departments experiencing a significant impact, and requiring the accumulation of substantial documentation (e.g. changes to business processes, requirements of federal and state specific laws or guidance, new funds or new programs), can draft a separate COVID-19 Pandemic Response Plan Appendix to the ICP as an organized set (hard or soft copies) of emails, documents, risk assessments, policies, and procedures.
Reasons for Noncompliance
SOC officials told us that the “COVID-19 Response Plan” was an evolving document during the pandemic. Therefore, it was not finalized and included as a COVID-19 Pandemic Response Plan Appendix within SOC’s ICP.
Recommendation
SOC should draft a COVID-19 Pandemic Response Plan Appendix, incorporate it into its ICP, and annually review and update the ICP and appendix with any necessary changes.
Auditee’s Response
The [draft audit report] found that the SOC did not incorporate a COVID-19 Response Plan into our Internal Control Plan (ICP) and therefore “the SOC could be vulnerable to not effectively and efficiently achieving its mission and objectives.”
The audit finding acknowledges that the SOC did have a COVID-19 Response Plan, but essentially discredits it since it was not specifically incorporated into the ICP and not labeled as an appendix. The finding is without merit and is based solely on where the documents sit. Maintaining our COVID-19 Response Plan separately has had no adverse effect on our operations and, in fact, has been very successful in enhancing our control environment during the pandemic. While the COVID‑19 Response Plan was not incorporated into the ICP, the SOC internal controls were updated in the Response Plan, focusing primarily on the potential impact of COVID on our operations.
There is no justifiable basis for describing the “error” to be significant and therefore the finding should be deleted. . . .
The finding also references updating the ICP itself, which is outside the scope of the objective listed on page 8 of the [draft audit report] that was limited to a COVID-19 Response Plan and not the ICP itself. In any event, the SOC is committed to ensuring that the ICP is updated as necessary and required.
Auditor’s Reply
The audit objective related to this finding involved reviewing SOC’s ICP during the audit period to determine whether the ICP included a COVID-19 response plan, as required by CTR’s “COVID-19 Pandemic Response Internal Controls Guidance.” Because the ICP was not updated during the audit period (during our fieldwork, SOC provided its most recent ICP that was updated before our audit period), the COVID-19 response plan was not incorporated into the ICP as required by this guidance. During our audit, SOC officials provided the components of the COVID-19 response plan in a separate document.
The Office of the State Auditor reiterates its recommendation that SOC should include those components as an appendix to its ICP to comply with CTR’s “COVID-19 Pandemic Response Internal Controls Guidance.”
| Date published: | January 13, 2023 |
|---|