Overview
During our audit, we found that the University of Massachusetts Building Authority’s (UMBA’s) internal control plan (ICP) had not been updated since February 15, 2019.
The absence of an updated ICP may hinder UMBA from identifying vulnerabilities that could prevent it from achieving its mission to assist and contribute to the performance of the educational and other purposes of the University of Massachusetts system.
Authoritative Guidance
There are no specific legal or regulatory requirements related to UMBA’s updating its ICP; however, according to Chapter 647 of the Acts of 1989, state agencies are required to develop and clearly document ICPs in accordance with guidelines established by the Office of the Comptroller of the Commonwealth. These guidelines require that an ICP be based on a risk assessment and revised annually.
The Office of the Comptroller of the Commonwealth’s Internal Control Guide states,
Your department is obligated to review and update your Internal Control Plan on an annual basis [emphasis added], as well as whenever there is a new objective, risk, or management structure. . . .
An internal control plan should have a statement of awareness and compliance with Chapter 647 [of the General Laws] guidelines in addition to the [Committee of Sponsoring Organizations’] eight [enterprise risk management framework] components.
Although UMBA is not required to follow these guidelines, since it is not a Commonwealth agency within the executive branch and is instead categorized as an independent agency, we consider them best practices.
Reasons for Issue
According to UMBA officials, there were no changes to the internal control environment at UMBA, and therefore, they have not updated their ICP. Furthermore, UMBA has not developed policies and procedures that require an annual review of its ICP.
Recommendation
UMBA should establish policies and procedures to ensure that its ICP is updated annually and that monitoring controls are put in place to guarantee adherence to these policies and procedures.
Auditee’s Response
As an Authority, Chapter 647 of the Acts of 1989 and the Comptroller of the Commonwealth’s Internal Controls Guide do not apply to UMBA. However, UMBA agrees that a strong internal control environment is necessary to ensure compliance, integrity, and transparency with all financial and operational functions. It is important to note that UMBA’s Board has affirmed this priority through its approved mission statement, which provides that “UMBA will serve the University and its campuses by performing with the highest levels of integrity and professional quality; by promoting accountability and efficiency . . .”
In order to promote and instill a strong culture that achieves the highest levels of competency throughout the organization, UMBA established an Internal Control Plan (“ICP”) in 2019. Although UMBA reviews its internal controls at the end of each fiscal year in connection with its independent financial audit, it has not officially documented an updated ICP since 2019. However, several internal UMBA control documents provided to the Office of the State Auditor reflect processes and procedures for specific financial and capital program operations that have been implemented and updated since 2019. Each of these processes, procedures and controls are reviewed during the financial audit with the independent financial audit firm.
UMBA agrees with the Office of the State Auditor that a written policy reflecting an annual review of the ICP will further enhance its controls. UMBA has prepared procedures affirming strong internal controls and specifying procedures for the annual review of UMBA’s ICP. The process outlined in UMBA’s procedures generally replicate the procedure currently followed by UMBA; however, UMBA will now specifically require that the ICP be reviewed and filed with the General Counsel noting the date of its final review. UMBA intends to inform its Board of these procedures at its next Board meeting in December, 2025.
UMBA thanks the Office of the State Auditor for all of its efforts and advice. UMBA always pursues means to ensure it operates at the highest levels as a steward for the University of Massachusetts.
Auditor’s Reply
Based on its response, UMBA is taking measures to address our concerns regarding this matter. As part of our post-audit review process, we will follow up on this matter in approximately six months.
| Date published: | December 18, 2025 |
|---|