Audit of the Executive Office of Elder Affairs (April 25, 2023)

This is a Massachusetts State Auditor performance audit of the Executive Office of Elder Affairs’ Protective Services Program, covering July 1, 2019 through June 30, 2021.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the Executive Office of Elder Affairs’ (EOEA’s) Protective Services Program for the period July 1, 2019 through June 30, 2021.”

Auditors checked whether the agency fixed problems from a prior audit and whether it followed rules for elder abuse referrals, decision-making assessments, COVID-19 internal controls, and cybersecurity training.

“In this performance audit, we examined whether EOEA implemented recommendations from our prior audit report (No. 2018-0004-3S), issued October 9, 2018.”

If serious elder abuse cases are not properly referred, older adults may remain in unsafe situations and prosecutors may not be alerted when they should be.

“As a result, EOEA cannot ensure that its designated PSAs are referring all incidents of alleged elder abuse to DAs’ offices as required, which can put elders at risk of continued abuse.”

For ordinary residents, this audit is about whether Massachusetts has strong enough checks to protect older adults from abuse, financial exploitation, neglect, and related risks.

“These 19 PSAs, if necessary, make referrals so that elders can seek other services, including, but not limited to, housing, nutrition, in-home support, caregiver support, and healthcare counseling.”

The agency had taken some steps, such as creating guidance, but the auditor found four oversight and compliance problems that still needed correction.

“Below is a summary of our findings and recommendations, with links to each page listed.”

The agency said it would add manual monitoring, build better automated review tools, update its internal control plan, and improve tracking of cybersecurity training.

“EOEA will assess the MassAchieve reporting capability and establish a process to track and monitor cybersecurity awareness training, determine an appropriate means by which to ensure such training is complete, and incorporate the resulting process into its policies and procedures to ensure compliance.”

The audit is significant because it found weaknesses in systems meant to protect older adults, manage pandemic-related controls, and reduce cybersecurity risk.

“If EOEA does not ensure that its employees complete cybersecurity awareness training, it is exposed to a higher risk of cyberattacks and financial and/or reputation losses.”

In this report, “elders” means people age 60 or older; “PSAs” are local protective service agencies; “DAs” are district attorneys; and the “IDA tool” is a screening form used to help decide whether an older adult may need a professional capacity evaluation.

“Persons who are 60 years old or older are considered elders.”