The Aeronautics Division does not have an internal control plan.

The lack of an ICP impedes the Aeronautics Division from identifying vulnerabilities that could prevent it from achieving organizational goals and objectives and exposes it to heightened risks in its operations.

Overview

The Aeronautics Division does not have an internal control plan (ICP). The division shared with us a draft copy of an ICP from 2016. The division has not implemented this draft ICP and has not documented the effect of, and evaluated the heightened risks created by, the 2019 coronavirus pandemic.

The lack of an ICP impedes the Aeronautics Division from identifying vulnerabilities that could prevent it from achieving organizational goals and objectives and exposes it to heightened risks in its operations.

Authoritative Guidance

Chapter 647 of the Acts of 1989 requires state agencies to maintain ICPs. In addition, the Office of the Comptroller of the Commonwealth (CTR) states in its Internal Control Guide,

Each department must maintain, and make available, an up-to-date Internal Control Plan. . . .

At the very least, the ICP must be reviewed and updated annually.

On September 30, 2020, CTR issued its “COVID-19 Pandemic Response Internal Controls Guidance” to all Massachusetts agencies. The guidance states,

1. If the impact to your department is such that it can be reflected in your Internal Control Plan (ICP), then update the ICP as you would for any other mid-year changes.
2. Departments experiencing a significant impact, and requiring the accumulation of substantial documentation (e.g. changes to business processes, requirements of federal and state-specific laws or guidance, new funds or new programs), can draft a separate COVID-19 Pandemic Response Plan Appendix to the ICP as an organized set (hard or soft copies) of emails, documents, risk assessments, policies, and procedures.

Reasons for Noncompliance

In a document provided to us by Aeronautics Division management, the division stated,

Due to the instability of the MassDOT Aeronautics Division program management systems (during the audit period) we have not finalized . . . the Internal Control Plan.

Recommendations

1. The Aeronautics Division should implement an ICP.
2. The Aeronautics Division should maintain an up-to-date ICP and should review and update it at least annually.

Auditee’s Response

Management concurs with the auditors’ Recommendations, and the following action will be taken to improve the situation.

The Aeronautics Division Director of Administration and Finance will begin immediately to finalize and implement the Aeronautics Division internal control plan (ICP). The ICP will be in compliance with the requirements and recommendations presented in Chapter 647 of the Acts of 1989 and the Office of the Comptroller of the Commonwealth (CTR) Internal Control Guide. In addition, the ICP will document the effects of, and evaluate the heightened risks created by, the 2019 coronavirus (COVID-19) pandemic.

The Aeronautics Division Director of Administration and Finance will work directly with the Aeronautics Division Administrator and the Deputy Administrator to ensure the ICP is reviewed and updated on an annual basis. Upon annual revision the Aeronautics Division Director of Administration and Finance will ensure that all Aeronautics Division staff are advised of all revisions.

Auditor’s Reply

Based on its response, the Aeronautics Division has taken measures to address our concerns on this matter.

Date published:	June 30, 2022