Seal of the Commonwealth of Massachusetts
Massachusetts Audit Explorer - what the State Auditor found

← all audits

Audit of the Massachusetts Bay Transportation Authority - Keolis Contract (March 4, 2025)

March 4, 2025 · Massachusetts Bay Transportation Authority · Read the full official report on mass.gov ↗ · official site ↗

Published March 4, 2025 Audit covers June 1, 2020 – December 31, 2023 Under Diana DiZoglio · 2023–present

In plain English
The auditor found that the MBTA did not properly oversee parts of its Keolis commuter rail contract, including penalties, incentives, records, reports, cybersecurity training, and internal controls.
source
“In this report, we found that the MBTA did not exercise adequate oversight over certain areas of its contract with Keolis Commuter Services, LLC, the operator of the MBTA’s commuter rail system.”
Read the plain-English breakdown
What is this?

This is a state performance audit of how the MBTA managed parts of its commuter rail contract with Keolis from June 2020 through December 2023.

“The purpose of our audit was to determine whether the MBTA effectively administered certain aspects of its contract with Keolis Commuter Services, LLC, referred to in this report as Keolis.”
Why was it audited?

The auditor says the MBTA needs steady oversight because it is large, complex, expensive, and provides important public services.

“Based on our research, the MBTA is a “high-risk” agency that warrants consistent oversight due to the size of its budget, the complexity of its operations, and the risks related to the services it provides.”
Why it matters

If the MBTA does not correctly use contract penalties and rewards, Keolis has less pressure to meet service standards and riders may get worse service.

“Failing to accurately assess these penalties and incentives undermines accountability and reduces the incentive for vendors to meet expectations.”
What's in it for me?

For riders and taxpayers, weak contract oversight can mean lost money, less reliable service, and costs that may have to be made up elsewhere.

“Because the MBTA also failed to assess an estimated $255,000 in penalties, this also resulted in a loss of revenue that must be compensated for through additional funding from riders or the Commonwealth and its taxpayers.”
The bottom line

The main finding is that the MBTA made major mistakes in calculating what Keolis owed or earned under the contract.

“The Massachusetts Bay Transportation Authority did not accurately assess performance-based incentives and penalties for Keolis.”
What happens next

The auditor recommends stronger policies, monitoring, verification, documentation, reporting reviews, cybersecurity training oversight, and an internal control plan.

“The MBTA should develop and implement sufficient policies and procedures, including a monitoring component, to ensure that the performance-based incentives and penalties it assesses Keolis are accurate and in accordance with the executed contract.”
Why it's significant

The report says the problems are not just paperwork issues: they affect accountability, safety, finances, service quality, and public trust.

“Failure to properly assess incentives and penalties could also reduce the public’s trust in the MBTA and harm its relationship with a vendor that relied on the MBTA’s calculations of incentives and penalties.”
Jargon, unpacked

Performance incentives and penalties are money-based rewards or charges meant to push a contractor to meet service promises, such as timeliness, staffing, cleanliness, and maintenance.

“Performance-based penalties and incentives are designed to incentivize vendors to achieve certain quality or timeliness standards and to hold them accountable for meeting agreed-upon service levels.”
Identified in this audit - source-verified
$3,942,060

10 figure(s) pending source verification - not shown

What the Auditor checked

What the Auditor found

The MBTA did not accurately assess performance-based incentives and penalties for Keolis.
procurement/contractsvendor oversightinternal controls

Why it matters: The errors undermined vendor accountability, reduced incentives to meet service standards, caused financial loss to the MBTA, and could diminish service quality and public trust.

Standard: Sections 13.1 of Part 1 and 1.1, 1.2, 1.3, and 1.4 of Schedule 6.1 of the MBTA contract with Keolis. ( Section 13.1 of Part 1 of the MBTA contract with Keolis, dated February 5, 2014; Sections 1.1, 1.2, 1.3, and 1.4 of Schedule 6.1 of the MBTA contract with Keolis, dated February 5, 2014 )

3 recommendations
  • Develop and implement policies and procedures, including monitoring, to ensure Keolis performance-based incentives and penalties are accurate and contract-compliant.agency: partially agreed
  • Implement a verification process for escalation factors used in incentive and penalty calculations.agency: partially agreed
  • Consider publicly reporting contractor performance.agency: partially agreed
Agency response & Auditor reply
Agency: "The MBTA disagrees with some of the SAO’s calculations and interpretations of contract language and has provided a detailed breakdown in its responses to the exceptions provided by the SAO."
Auditor: "According to its response, the MBTA has already begun to make improvements based on some of our recommendations and will continue to use this report in making improvements to the operations of the MBTA."
The MBTA did not keep sufficient inspection documentation for several areas of Keolis performance.
recordkeeping/documentationvendor oversightinternal controlspublic safety

Why it matters: Insufficient documentation exposed MBTA customers to safety, accessibility, service, revenue, and accountability risks.

Standard: Section 2 of Schedule 6.1 of the operating agreement with Keolis. ( Section 2 of Schedule 6.1 of the operating agreement )

2 recommendations
  • Establish policies and procedures to monitor station maintenance, snow and ice removal, ADA inspections, locomotive and coach availability, and fare collections.agency: partially agreed
  • Document all inspections regardless of outcome.agency: partially agreed
Agency response & Auditor reply
Agency: "The MBTA agrees that improvements can and are in the process of being made to the documentation process for certain types of inspections."
Auditor: "We disagree with the MBTA’s claim that our audit was not constrained."
The MBTA did not always enforce monthly and annual performance incentive caps.
procurement/contractsvendor oversightinternal controls

Why it matters: The MBTA paid Keolis more than the contract permitted for some monthly and annual performance incentives.

Standard: Section 6.5 of Schedule 6.1 of the amended MBTA contract with Keolis, dated July 1, 2020. ( Section 6.5 of Schedule 6.1 of the amended MBTA contract with Keolis, dated July 1, 2020 )

2 recommendations
  • Establish policies and procedures to monitor and enforce monthly and annual performance incentive caps.agency: partially agreed
  • Implement a verification process to ensure correct escalation factors are used when calculating annual incentive caps.agency: partially agreed
Agency response & Auditor reply
Agency: "The MBTA disagrees with some of the SAO’s analysis and has provided a detailed breakdown in its responses to the exceptions provided by the SAO."
Auditor: "This error highlights an underlying issue of ineffective controls and insufficient oversight processes."
The MBTA did not ensure Keolis submitted required fare revenue and fleet maintenance reports on time or penalize late submissions.
reporting timelinessvendor oversightprocurement/contracts

Why it matters: Late reports deprived MBTA personnel of information needed for decisions and performance monitoring, and unassessed penalties reduced revenue.

Standard: Appendix 1 of Schedule 3.14 and Section 20.1 of Schedule 3.18 of the operating agreement with Keolis. ( Appendix 1 of Schedule 3.14 of the operating agreement with Keolis; Section 20.1 of Schedule 3.18 of the operating agreement with Keolis )

1 recommendation
  • Establish policies and procedures to monitor receipt, review, and follow-up of required Keolis reports, including monitoring, reporting, and financial review components.agency: disagreed
Agency response & Auditor reply
Agency: "The MBTA disagrees that it failed to ensure the Keolis submitted reports relating to fare collection revenue and fleet maintenance on time and as such disagrees that any penalties were appropriate to be assessed to Keolis."
Auditor: "This failure to identify and penalize Keolis for the delay highlights the inadequacy of the MBTA’s monitoring process in this area during the audit period."
The MBTA did not ensure Keolis employees with TRMS access completed annual cybersecurity awareness training.
cybersecurityvendor oversightinternal controls

Why it matters: The lack of training increased cybersecurity, financial, reputational, and data integrity risks for MBTA information technology systems.

Standard: Section 4.1.5 of Schedule 3.17 of the MBTA’s “Commuter Rail Operating Agreement 159–12.”

2 recommendations
  • Establish policies and procedures, including monitoring, to ensure contracted service provider employees with access to MBTA IT systems complete cybersecurity awareness training.agency: partially agreed
  • Ensure contractor compliance with all contract terms and retain sufficient documentation.agency: partially agreed
Agency response & Auditor reply
Agency: "The MBTA with Keolis have identified the Keolis employees that did not complete annual cybersecurity training."
Auditor: "This information was not available through the MBTA’s own records or monitoring processes, highlighting the lack of oversight and enforcement by the MBTA."
The MBTA did not have an internal control plan.
internal controls

Why it matters: Without an internal control plan based on a department-wide risk assessment, the MBTA was limited in identifying vulnerabilities and exposed to heightened operational risks.

Standard: Chapter 647 of the Acts of 1989, identified by the Auditor as a best practice for internal controls. ( Chapter 647 of the Acts of 1989 )

2 recommendations
  • Develop an internal control plan based on a current department-wide risk assessment covering all business activities.agency: partially agreed
  • Communicate, use, review, and update the internal control plan at least annually.agency: partially agreed
Agency response & Auditor reply
Agency: "The MBTA does not disagree that it does not have an authority wide internal control plan."
Auditor: "We recognize that the MBTA is a quasi-public agency and, therefore, is not required to comply with Chapter 647 of the Acts of 1989."
The MBTA did not effectively monitor Keolis’s compliance with disadvantaged business enterprise requirements.
grants managementprocurement/contractsvendor oversightinternal controls

Why it matters: Without formal review, the MBTA was limited in evaluating whether Keolis accurately reported DBE spending and supported contracting with eligible DBEs.

Standard: Part 26 of Title 49 of the Code of Federal Regulations, Section 4.5.3.1 of the Instructions to Proposers, and Section 4.1 of Schedule 3.13 of the MBTA operating agreement with Keolis. ( Part 26 of Title 49 of the Code of Federal Regulations; Section 4.5.3.1 of the Instructions to Proposers document for MBTA Request for Proposal No. 159–12; Section 4.1 of Schedule 3.13 of the MBTA’s operating agreement with Keolis )

1 recommendation
  • Develop, document, and implement policies and procedures to monitor Keolis’s compliance with DBE requirements, including accurate DBE award and financial reporting.agency: partially agreed
Agency response & Auditor reply
Agency: "The MBTA appreciates the SAO’s input and suggestions when it comes to the handling of monitoring Keolis’ compliance with disadvantaged business enterprise (“DBE”) requirements."
Auditor: "Since the end of the audit period, the MBTA has implemented policies and procedures aimed at addressing the issues identified in our audit."
Keolis entered into a settlement agreement with a DBE firm that included confidentiality clauses.
procurement/contractsvendor oversight

Why it matters: The confidentiality clauses may prevent sharing critical information about Keolis’s DBE practices, reducing oversight and accountability.

1 recommendation
  • Develop and implement policies and procedures related to settlement agreements involving subcontractors and vendors for work under MBTA contracts.
The audit process was constrained by MBTA delays and inaccurate or inconsistent information.
recordkeeping/documentationinternal controls

Why it matters: The delays and incorrect information wasted public resources, delayed the audit, and raised concerns about MBTA accountability and audit commitment.

Verified dollar findings

Revenue not collected $3,942,060

Money the entity was owed but failed to assess or collect - unassessed penalties, underpaid incentives.

$3,324,126 - unassessed penalties
$257,724 - inappropriately assessed penalties
$105,210 - underpaid incentives
$255,000 - unassessed penalties

More audits of this entity

Other Office of the State Auditor reports on Massachusetts Bay Transportation Authority .

See this entity's page with all 11 audits →