Audit of the Cape and Islands District Attorney’s Office (November 25, 2025)

This is a Massachusetts State Auditor performance audit of the Cape and Islands District Attorney’s Office, covering mostly July 2022 through June 2024, with a longer lookback for employee settlement agreements.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of the Cape and Islands District Attorney’s Office (CIDAO) for the period July 1, 2022 through June 30, 2024.”

Auditors checked whether the office followed rules and best practices for sexual assault evidence kit tracking, cybersecurity training, employee settlement policies, and reporting monetary settlements to the state comptroller.

“The purpose of this audit was to determine the following:”

The issues matter because they involve sensitive survivor information, public accountability around employee payments, and the office’s exposure to cybersecurity risks.

“If CIDAO does not promptly revoke former employees’ access rights to the Track-Kit system, then there is a risk of unauthorized access to sensitive case and survivor information.”

For residents, the practical concern is whether a public prosecutor’s office is protecting sensitive information, handling taxpayer-funded settlements properly, and training employees to reduce cyber risks.

“Without educating its employees on their responsibility to protect the security of information assets, CIDAO exposes itself to a higher risk of cybersecurity attacks and financial and/or reputational losses.”

The auditor concluded that the office did not participate enough in the sexual assault kit tracking system, did not meet cybersecurity training expectations, and lacked documented settlement policies.

“No; see Finding 2”

The auditor recommended written policies, better access controls, staff training, settlement recordkeeping, and coordination with state agencies; the auditor also said the office’s progress will be checked later.

“We will follow up on this matter in approximately six months, as part of our post-audit review process.”

The report points to gaps in basic government controls at an office that handles criminal cases, sensitive victim-related information, public funds, and employee records.

“The Track-Kit system was designed to increase transparency, accountability, and survivor-centered care in the handling of SAECKs.”

CIDAO means the Cape and Islands District Attorney’s Office. SAECK means a sexual assault evidence collection kit. Track-Kit is the state web system used to track those kits from collection through later steps.

“EOPSS implemented the web-based Track-Kit system to allow all users to trace a SAECK’s location from distribution to collection to processing to storage.”