Audit of the Department of Conservation and Recreation

This is a Massachusetts State Auditor performance audit of the Department of Conservation and Recreation covering July 1, 2019 through June 30, 2021.

“This report details the audit objectives, scope, methodology, findings, and recommendations for the audit period, July 1, 2019 through June 30, 2021.”

The audit checked whether DCR had systems to make sure construction contractors followed workforce participation goals and business ownership goals for women and minorities.

“In this performance audit, we determined whether DCR had internal tracking, oversight, and enforcement procedures to ensure that contractors complied with its workforce participation goal1 in accordance with Section 44A(1)(G) of the General Laws and the Executive Office of Administration and Finance administrative bulletin “Equal Opportunity and Non-discrimination on State and State-Assisted Construction Contracts.””

If DCR does not collect and review the right information, it cannot tell whether contractors are actually meeting required goals for women and minority participation.

“Without adequate processes or procedures, DCR could not collect the data to calculate the workforce participation goal achieved for the 99 construction contracts that were active during our audit period.”

DCR manages public parks, forests, reservations, campgrounds, swimming pools, and bike trails, so its contracting practices affect public projects connected to places ordinary residents use.

“It operates under the direction of the Executive Office of Energy and Environmental Affairs and is responsible for the administration and oversight of state parks, forests, reservations, and recreational facilities (e.g., campgrounds, swimming pools, and bike trails).”

The audit found three main problems: weak monitoring of workforce participation goals, missing payment certificates needed to track business ownership goals, and incomplete cybersecurity training.

“DCR did not ensure that all employees completed required annual cybersecurity awareness training during the audit period.”

The auditor recommended that DCR create and use clearer policies, procedures, monitoring, and enforcement steps; DCR said it has taken measures to address some concerns.

“DCR should develop policies and procedures to effectively monitor the extent to which each construction contractor achieves the business ownership goal for women and minorities.”

The report matters because weak oversight can make diversity goals unenforceable in practice, and weak cybersecurity training can expose the agency to avoidable risks.

“If employees do not receive cybersecurity awareness training, DCR could face a higher risk of cybersecurity attacks and financial and/or reputation losses.”

A workforce participation goal means a required share of construction work hours that should be performed by women and minority workers.

“Workforce participation goals are the percentages of work hours for each construction contract that must be worked by minorities and women.”