Audit of the Commonwealth Corporation

This is a Massachusetts State Auditor performance audit of Commonwealth Corporation covering July 1, 2015 through June 30, 2018.

“This report details the audit objectives, scope, methodology, findings, and recommendations for the audit period, July 1, 2015 through June 30, 2018.”

Auditors reviewed how CommCorp managed a workforce training grant program, protected personal information, and followed public financial reporting rules.

“In this performance audit, we examined certain activities of CommCorp’s administration of the General Program within its Workforce Training Fund Program, its protection of personally identifiable information in its records, and its compliance with the General Laws regarding providing its financial records to the Secretary of Administration and Finance for public disclosure.”

The audit matters because a hacker accessed payroll information from W-2 forms for 164 current and former employees, putting them at possible risk of fraud.

“Current and former employees affected by this breach may be at risk of fraud.”

For an ordinary citizen, the key issue is whether a publicly connected agency is protecting sensitive worker data and making its spending visible to the public.

“As a result, CommCorp did not allow the Commonwealth to give the public a sufficient level of transparency regarding CommCorp’s operations, including its overall financial health and the nature and extent of its expenses.”

The auditor found two problems: CommCorp did not adequately safeguard confidential employee information, and it did not submit all required payroll and spending information for public posting.

“CommCorp did not submit required payroll and expenditure information to the Commonwealth to be made available to the public on a searchable website.”

The auditor recommended stronger security training and controls, plus policies to make sure payroll and spending information is submitted for public posting.

“CommCorp should develop policies and procedures that require periodic security awareness training for all employees.”

The report is significant because it found weaknesses in both cybersecurity and public accountability at a quasi-public agency that administers workforce training grants funded through state unemployment tax payments.

“The program’s purpose is to enhance business productivity and competitiveness by providing resources to medium-sized and small businesses to upgrade their workforces’ skills.”

Personally identifiable information means data that can identify a person; in this report, the concern was payroll data from employees’ W-2 tax forms.

“The hacker accessed payroll data from 164 current and former employees’ federal W-2 forms for the period 2008 through 2017.”