The Massachusetts Board of Library Commissioners Did Not Take Corrective Measures to Address All the Issues Identified in our Prior Audit

Audit found that the MBLC did not adequately address three issues previously identified in 2014 audit.

Overview

An objective for the current audit was to determine whether the planned actions in the auditee’s responses to the findings from the prior audit (No. 2013-0165-3S), issued in October 2014, had been implemented. The current audit identified one that had been adequately addressed. The remaining three, and the results of the audit procedures from our current audit, are discussed below.

The MBLC Did Not Ensure That it Received Monthly Project Reports in a Timely Manner

In our prior audit, we determined that monthly construction project reports for the Massachusetts Public Library Construction Program (MPLCP) were submitted late, or in some cases not at all, to the Massachusetts Board of Library Commissioners (MBLC) by library directors / project managers. In that audit, we determined that 46 reports (28% of the sample tested) were received up to five months late, and 57 reports (35% of the sample tested) were not received at all. Missing reports could prevent MBLC from receiving necessary project information. Delayed reports may be less relevant and useful than timely ones and could reduce MBLC’s ability to make informed decisions about grantees’ performance and adherence to grant agreement provisions, as well as its ability to ensure that MPLCP grant funds are properly accounted for and appropriately spent.

During the current audit, our initial review of a nonstatistical random sample of 28 MPLCP construction project reports due during the audit period showed that 17 (61%) of the construction project reports arrived late (some up to five months late) and 3 (11%) were never submitted to MBLC for review.

 

Authoritative Guidance

In response to the previous audit report, the auditee committed to assigning MPLCP construction reports a due date one month after the end of the reporting month and sending an alert five days before the deadline.

 

Reasons for Noncompliance

MBLC management indicated that there had been significant managerial staffing changes since the prior audit, affecting its ability to implement the policies and procedures recommended in our prior report.

MBLC Did Not Conduct Site Visits to All Sub-Grantees

In our prior audit, we determined that MBLC’s Library Services and Technology Act (LSTA) consultants¹ did not document on Site Visit Report forms their visits to sub-grantee sites. Our current audit showed that in some instances, LSTA consultants did not actually conduct required site visits. We selected a nonstatistical random sample of 12 of the 63 site visits that LSTA consultants were required to make to projects that were ongoing during the audit period, and we identified 3 instances in which LSTA consultants did not conduct required site visits. Because it is not ensuring that all these site visits are conducted, MBLC is not taking all the measures necessary to ensure that libraries that receive sub-grants comply with all sub-grant requirements. Additionally, MBLC may not have the most recent and accurate information available about its ongoing projects, which it needs to communicate to the Institute of Museum and Library Services (the overseer of states’ administration of the LSTA Grants to States Program) and the State Advisory Council on Libraries.

 

Authoritative Guidance

Part 3 of the Office of Management and Budget Circular A-133 Compliance Supplement for 2013, which was in effect during the audit period, includes a sub-recipient monitoring requirement for pass-through entities. (MBLC is considered a pass-through entity because it receives federal LSTA grants from which it provides sub-grants to libraries.)

Monitoring activities normally occur throughout the year and may take various forms, such as:

• Reporting—Reviewing financial and performance reports submitted by the subrecipient.
• Site Visits—Performing site visits at the subrecipient to review financial and programmatic records and observe operations.
• Regular Contact—Regular contacts with subrecipients and appropriate inquiries concerning program activities.

To ensure compliance with this requirement, MBLC’s internal control plan (ICP) states, “Consultants will do at least one site visit with each grant recipient.”

Site visits are an important aspect of proper project administration, as they allow MBLC to perform activities such as accurately assessing the progress of a project, determining whether a project is on schedule, and identifying any problems that might be causing project delays and possibly cost overruns so that they can be addressed expeditiously.

 

Reason for Noncompliance

According to MBLC management, because of staffing issues, the agency allowed LSTA consultants to conduct telephone interviews on the occasions in question instead of onsite visits. However, they did not complete either Site Visit Report forms or some other type of record to substantiate this.

MBLC’s ICP Did Not Comply with Comptroller Requirements & MBLC Had Not Established Adequate Controls

In our prior audit, we determined that MBLC’s ICP did not comply with all of the Office of the State Comptroller’s (OSC’s) requirements. As of our current audit period, the MBLC had not performed any substantive updates to the ICP since 2015, and the ICP in place did not address all eight components of enterprise risk management (ERM). In addition, MBLC did not have any policies and procedures in place to ensure that annual activities related to the proper development and updating of its ICP were conducted. Without assurance that these activities are performed in accordance with all OSC requirements, MBLC may not have a control structure that ensures that it achieves its objectives efficiently and effectively.

 

Authoritative Guidance

OSC’s 2015 Internal Control Guide states,

The internal control plan is a summary describing how a department expects to meet its various goals and objectives by using mitigating controls to minimize risk. Each department’s internal control plan will be unique; however it must be based on the ERM framework discussed in this guide.

Management is responsible for operating an effective system of monitoring whereby all ERM components are periodically reviewed. Consistent monitoring of all components will ensure that the ICP (which must be reviewed and updated at least annually) is updated whenever changing conditions warrant.

Since a department’s policies and procedures are the control activities for the internal control plan, it is important that they be reviewed in conjunction with the plan, and referenced where appropriate. Everyone in the organization has a responsibility to ensure that internal controls operate effectively.

Reasons for Issues

MBLC officials stated that extended vacancies (which had recently been filled) in three senior management positions made it unable to properly train employees as necessary to give them a comprehensive understanding of agency policies and procedures that are required to accurately update and complete the ICP.

Recommendations

1. MBLC should enhance its policies and procedures for the administration of its monthly construction reports. The policies and procedures should include a requirement that the reports be submitted after the report month’s end, by a specific date, and follow-up procedures to ensure that they are submitted on time.
2. MBLC management should take the measures necessary to ensure that all site visits are conducted as required and that Site Visit Report forms are completed to document each visit.
3. MBLC should prepare an updated ICP that includes and identifies all eight components of ERM and develop proper internal controls over this activity to ensure that it is properly conducted annually.

Auditee’s Response

Finding 1a . . . regarding library construction reports:

The agency does have policies and procedures in place for the administration of its monthly construction reports. As part of their grant materials, grantees are notified of the requirement to submit reports within 30 days after the end of each month, with a final report due within 180 days of the final payment. Monthly reminders are emailed to the library director where the project is taking place. Reports are received, date stamped, logged, and filed. . . .

The finding in this review period (that reports were submitted late or in some cases not at all) is accurate and we are adding to our procedures to ensure that the reports are submitted in a timely manner.

Finding 1b . . . regarding LSTA sub-grantee site visits:

It is accurate that not all site visits in this review period were conducted. This occurred in 3 instances and all missed site visits were visits that were supposed to be conducted by one staff member.

Finding 1c . . . regarding the ICP:

The findings are accurate.

Auditor’s Reply

Based on its response, MBLC is taking some measures to address our concerns in this area, but we again recommend that it consider implementing all of our recommendations, which we believe should adequately address the issues we identified during our audit.

1. These employees’ job title is “consultant,” but they are permanent, full-time MBLC employees.

 

Date published:	July 10, 2018