Audit of the Essex County District Attorney’s Office (November 25, 2025)
November 25, 2025 · Essex County District Attorney’s Office · Read the full official report on mass.gov ↗
Published November 25, 2025 Audit covers July 1, 2022; July 1, 2019 for employee settlement agreements – June 30, 2024 Under Diana DiZoglio · 2023–present
source
“Below is a summary of our findings, the effect of those findings, and our recommendations, with hyperlinks to each page listed.”
Read the plain-English breakdown
This is a Massachusetts State Auditor performance audit of the Essex County District Attorney’s Office, covering mostly July 1, 2022 through June 30, 2024, with a longer lookback for employee settlement agreements.
“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of the Essex County District Attorney’s Office (EDAO) for the period July 1, 2022 through June 30, 2024.”
Auditors checked whether the office properly used the sexual assault evidence kit tracking system, made employees complete cybersecurity training, and had procedures for employee settlement agreements.
“The purpose of our audit was to determine the following:”
These issues matter because they involve sensitive survivor and case information, cybersecurity risks, and fair handling of employee settlements.
“If EDAO does not promptly revoke former employees’ access rights to the Track-Kit system, then there is a higher-than-acceptable risk of unauthorized access to sensitive case and survivor information.”
For ordinary residents, especially sexual assault survivors, better use of the tracking system can make it easier to know who to contact and reduce confusion about evidence kits.
“Having EDAO contact information assigned to SAECKs allows survivors to have an informed single point of contact and can streamline outreach and reduce confusion.”
The auditor concluded that EDAO fell short in all three areas reviewed: kit tracking participation, cybersecurity training, and settlement-agreement procedures.
“To an insufficient extent; see Finding 1 and Other Matters”
EDAO said it would take steps to fix the problems, and the Auditor’s Office said it plans to check back in about six months.
“As part of our post-audit review process, we will follow up on this matter in approximately six months.”
The report points to weaknesses in systems meant to protect sensitive information, support survivors, and make government decisions consistent and accountable.
“The Track-Kit system was designed to increase transparency, accountability, and survivor-centered care in the handling of SAECKs.”
SAECK means a sexual assault evidence collection kit: the sealed kit used during a forensic medical exam after a sexual assault, with evidence that may later be used by police or prosecutors.
“A SAECK is a sealed box containing a detailed protocol and all the medical equipment to conduct a thorough forensic medical exam of sexual assault survivors at the time of the assault.”
What the Auditor checked
- Partially To what extent did EDAO participate in the statewide sexual assault evidence collection kit (SAECK) tracking system as required by Section 18X(g) of Chapter 6A of the General Laws?
- Did not comply Did EDAO ensure that all of its employees completed cybersecurity awareness training in accordance with its “Security Training and Awareness” policy and Section 6.2.3 of the Executive Office of Technology Services and Security’s (EOTSS’s) Information Security Risk Standard IS.010?
- Did not comply Did EDAO have internal policies and procedures in place for (a) the review and approval of employee settlement agreements, including the use of non-disclosure, non-disparagement, or similarly restrictive clauses, and (b) the reporting of monetary employee settlements to the Office of the Comptroller of the Commonwealth (CTR) in accordance with Sections 5.06 and 5.09 of Title 815 of the Code of Massachusetts Regulations (CMR)?
What the Auditor found
Why it matters: This increased the risk of unauthorized access to sensitive case and survivor information and limited the system’s usefulness for survivor communication.
Standard: Section 18X(g) of Chapter 6A of the General Laws; Track-Kit User Manual; EOPSS’s “Policies and Procedures for Sexual Assault Evidence Collection Kit Tracking,” dated January 2020. ( Section 18X(g) of Chapter 6A of the General Laws; EOPSS’s “Policies and Procedures for Sexual Assault Evidence Collection Kit Tracking,” dated January 2020 )
2 recommendations
- EDAO should develop, document, and implement policies and procedures for adding access authorization for new users and revoking user access to the Track-Kit system upon termination of a user’s employment.agency: agreed
- EDAO should assign its contact information to each SAECK within its jurisdiction in the Track-Kit system and should train its employees on how to use this system.agency: agreed
Agency response & Auditor reply
Agency: "We acknowledge our statutory obligation to actively participate in the statewide sexual assault evidence collection kit (SAECK) tracking system, known as Track-Kit."
Auditor: "Full participation in the Track-Kit system is necessary to meet the law’s intent and ensure consistent, survivor-centered practices across the Commonwealth."
Why it matters: This exposed EDAO to increased risk of cybersecurity attacks and financial or reputational losses.
Standard: EDAO’s “Security Awareness Training” policy and Section 6.2.3 of EOTSS’s Information Security Risk Standard IS.010. ( Section 6.2.3 of the Executive Office of Technology Services and Security’s Information Security Risk Standard IS.010 )
1 recommendation
- EDAO should implement effective monitoring controls to ensure that all employees complete agency-required bimonthly cybersecurity awareness training and that newly hired employees complete initial training within the first 30 days of their new hire orientation.agency: agreed
Agency response & Auditor reply
Agency: "We recognize that our monitoring controls were not as effective as they should have been."
Auditor: "Based on its response, EDAO is taking measures to address our concerns regarding this matter."
Why it matters: Without a documented process, EDAO could not ensure employee settlements would be handled equitably, ethically, legally, and consistently.
Standard: US Government Accountability Office’s Standards for Internal Control in the Federal Government, known as the Green Book. ( US Government Accountability Office’s Standards for Internal Control in the Federal Government )
2 recommendations
- EDAO should update its “Policies, Procedures, and Guidelines—Settlements and Judgments,” effective July 2024, to include review and approval of agreement terms by the District Attorney and chief legal counsel.agency: already implemented
- EDAO should ensure that its “Policies, Procedures, and Guidelines—Settlements and Judgments,” effective July 2024, is formally communicated to all relevant employees and fully integrated into its operations.agency: agreed
Agency response & Auditor reply
Agency: "We have revised this policy to formalize a documented and transparent process for handling any future employee settlements."
Auditor: "Based on its response, EDAO is taking measures to address our concerns regarding this matter."
More audits of this entity
Other Office of the State Auditor reports on Essex County District Attorney’s Office .
- Audit of the Essex County District Attorney's OfficeDistrict Attorney · February 11, 2022