Overview
The Office of Consumer Affairs and Business Regulation (OCABR) does not reconcile the revenue information in its financial records to the revenue information in its home improvement contractor (HIC) registration database and to the Massachusetts Management Accounting and Reporting System (MMARS). We performed a reconciliation of all HIC registration and Residential Contractor’s Guaranty Fund (RCGF) fee revenue OCABR received during the audit period, as documented in its financial records, to the revenue information in its HIC registration database and MMARS and found a significant variance. The revenue that OCABR recorded in MMARS was $95,026 lower than what was recorded in OCABR’s HIC registration database and the overall financial records. OCABR officials were not aware of the variance and could not explain why it might have occurred. Because OCABR does not perform reconciliations of all of its financial records, there is a higher-than-acceptable risk of variances (such as the $95,026 we identified, which could represent losses of funds), occurring and going undetected.
In addition, when reviewing OCABR’s internal controls over revenue reconciliation, we noted that there was inadequate segregation of duties regarding the funds OCABR receives both in person at its office and by mail. Specifically, two OCABR employees receive funds in person and by mail, record financial transactions in a daily cashbook spreadsheet, deposit the funds, and report the amount of revenue collected each day to OCABR’s director of accounting, who records the amounts in the agency’s financial records. The same two employees are also able to access OCABR’s HIC registration database and change the amounts charged to HIC applicants without oversight or authorization. Therefore, there is a higher-than-acceptable risk of funds being misappropriated.
Authoritative Guidance
The Office of the Comptroller of the Commonwealth’s (CTR’s) “Cash Recognition and Reconciliation Policy,” issued July 1, 2004, requires that all departments reconcile all received revenue in their internal accounting records to activity reported in MMARS:
Daily system assurance must be performed by departments to ensure that there is a matching deposit for each cash transaction. This process involves comparing the results from all sources that produce or contain payments and deposit information, and ensuring that they match. These information sources should include . . . all relevant MMARS tables.
Section 10.04 of CTR’s Internal Control Guide from June 2015, which OCABR is required to follow, states,
Management should divide or segregate key duties and responsibilities among different people to reduce the risk of error, misuse, or fraud. This includes separating the responsibilities . . . so that no one individual controls all key aspects of a transaction or event.
Reasons for Issue
OCABR lacks policies and procedures that require its staff to perform regular reconciliations of its financial records and that establish segregation of duties over the receipt, recording, deposit, and reporting of revenue.
Recommendations
- OCABR should develop policies and procedures that require its staff to perform regular reconciliations of its financial records.
- OCABR should establish segregation of duties over the receipt, recording, deposit, and reporting of revenue.
- OCABR should investigate and resolve the $95,026 variance.
Auditee’s Response
OCABR acknowledges that during the audit period it did not require its staff to perform regular reconciliations of HIC financial records. However, as of June 2020, staff are required to perform regular reconciliations of all HIC monies and transactions, and these activities are set forth in the OCABR policy entitled “HIC Registration Procedures—Application Review and Processing.” The daily reconciliation process requires HIC registration staff to produce and distribute daily transaction reports from the HIC registration database and reconcile the daily transactions with daily receipts of payments from HIC contractors. With the implementation of this process, any variance is immediately identified and resolved. HIC registration staff then provides OCABR’s accounting unit with the daily transaction reports and daily receipts and deposits. The accounting unit subsequently reviews and confirms the reconciliation. Additionally, on a monthly basis, the accounting unit conducts a full monthly reconciliation to ensure all transactions and deposits are reconciled within the database, the bank, and Massachusetts Management Accounting and Reporting System (MMARS).
In the months since being notified of the variance, OCABR has reconciled, down to the penny, the HIC registration transactions with monies for June, July, August, September, October, November, and December of 2020. . . .
OCABR recognizes that segregation of duties is essential to the successful recording, depositing, and reporting of revenue. As a result of working with your office, in June 2020 OCABR implemented a plan to segregate duties so that different employees perform the receipt, recording, depositing, and reporting of HIC revenue. The employee who processes the HIC transaction no longer reconciles the daily activity to the daily receipts. OCABR’s senior staff provides daily oversight, guidance and communication to ensure adherence to the process for separation of duties. . . .
On May 20, 2020, the OSA notified OCABR of an apparent variance between the fee revenue OCABR received during the audit period, as documented in its financial records, to the revenue information in its HIC registration database and MMARS. Upon learning of the variance, OCABR promptly initiated an investigation. After conducting extensive internal reviews and a detailed analysis of all pertinent financial records, OCABR was not able to discover the cause of the variance. We then notified senior staff at the Executive Office of Housing and Economic Development (EOHED), who immediately deployed information technology (IT) resources to examine the HIC IT systems and programs in an effort to determine whether there were any technology-related explanations for the variance. Based on that review, OCABR has concluded that the technology was functioning properly and was not the cause of the variance.
OCABR staff also performed a manual cross referencing of each of the copies of checks for the two year audit period with each of the database entries, but was unable to determine the reason for the variance. EOHED finance staff independently reviewed this methodology, but this review did not ascertain the basis of the variance.
In November, OCABR notified the Office of the Attorney General’s (AGO) White Collar / Public Integrity Division of the variance and the relevant circumstances pertaining to it. At this time, OCABR is continuing to work with the AGO on investigating this matter.
Auditor’s Reply
Based on its response, OCABR is taking measures to address these issues.
| Date published: | March 10, 2021 |
|---|