Audit of the Division of Professional Licensure

This is a Massachusetts State Auditor performance audit of the Division of Professional Licensure covering July 1, 2017 through March 31, 2020.

“This report details our audit objectives, scope, methodology, and conclusions for the audit period, July 1, 2017 through March 31, 2020.”

The audit was meant to determine whether DPL followed its own process for checking license applicants' criminal record and sex offender record information.

“The purpose of this audit was to determine whether DPL performed Criminal Offender Record Information (CORI) and Sex Offender Record Information (SORI) checks for license applicants in accordance with the requirements of its license application process.”

DPL oversees licensing for many jobs and businesses, so weak background-check controls could affect public safety and consumer protection.

“DPL’s mission is to protect the public health, safety and welfare by licensing qualified individuals and businesses to provide services to consumers, while ensuring the fair and consistent enforcement of licensing laws and regulations.”

If you live in Massachusetts, this matters because DPL licenses and regulates hundreds of thousands of workers, businesses, and schools that may provide services to the public.

“Collectively, DPL boards and offices license and regulate more than 580,000 individuals, businesses, and schools to engage in over 150 trades and professions in Massachusetts.”

The auditor could not reach a clear yes-or-no answer because DPL's systems lacked reliable background-check data, but the report still identified several process problems DPL should fix.

“We could not determine whether DPL conducted CORI or SORI checks for all license applicants because the data in DPL’s Accela2 and MyLicense3 Office software had significant limitations and did not provide an adequate basis for addressing our audit objectives.”

The auditor recommended stronger policies, better documentation, more consistent background-check procedures, and a compliant internal control plan; DPL said it had begun creating procedures and a centralized background check unit.

“DPL should establish policies and procedures that standardize the background check process for all of its boards and agencies that use vendors to perform their licensing-related activities so that no vendor can issue a license to an applicant before the applicant has passed a CORI check.”

The report points to a serious oversight issue: DPL did not have enough controls or reliable records to show that background checks were consistently done before licenses were issued.

“This control deficiency increases the risk of a vendor issuing a license to someone who may have a criminal record that should preclude him/her from obtaining the license.”

CORI means criminal record information, SORI means sex offender record information, and an internal control plan is the agency's system for managing risks and making sure required procedures are followed.

“To comply with CTR internal control guidelines, an ICP must contain information on the eight components of ERM: internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, and monitoring.”