Seal of the Commonwealth of Massachusetts
Massachusetts Audit Explorer - what the State Auditor found

← all audits

Audit of the Massachusetts Cultural Council (November 26, 2025)

November 26, 2025 · Massachusetts Cultural Council · Read the full official report on mass.gov ↗

Published November 26, 2025 Audit covers July 1, 2022 – June 30, 2024 Under Diana DiZoglio · 2023–present

In plain English
The audit found that the Massachusetts Cultural Council generally handled grant programs properly, but it did not always make sure local cultural councils filed required reports on time, and it did not make sure all contractors completed cybersecurity training.
source
“MCC did not ensure that local cultural councils complied with the annual reporting requirements outlined in its “Local Cultural Council Program Guidelines.””
Read the plain-English breakdown
What is this?

This is a state performance audit of the Massachusetts Cultural Council, covering selected activities from July 1, 2022 through June 30, 2024.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of the Massachusetts Cultural Council (MCC) for the period July 1, 2022 through June 30, 2024.”
Why was it audited?

Auditors checked whether MCC followed its grant rules, made sure local cultural councils met reporting rules, and followed up when councils were out of compliance.

“The purpose of our audit was to determine the following:”
Why it matters

These grants involve public money meant for arts, humanities, and science programs, so late or missing reports can weaken accountability over how that money is used.

“If MCC does not ensure that LCCs meet deadlines, it increases the risk of public funds being used for activities not related to arts, humanities, and sciences, which could undermine MCC’s commitment to promoting cultural activities.”
What's in it for me?

If you live in Massachusetts, this affects how state cultural funding is overseen in local communities and whether public arts and culture money is tracked before it is spent.

“MCC also distributes funds to local and regional cultural councils, which then regrant funds to arts, humanities, and science projects in their communities.”
The bottom line

The auditors found no major problems with how MCC set up and ran its grant programs, but they did find weaknesses in local council reporting oversight and contractor cybersecurity training.

“For this objective, we found no significant issues during our testing.”
What happens next

MCC says it is making changes, and the Auditor’s office plans to check back on the reporting and cybersecurity issues in about six months.

“As part of our post-audit review process, we will follow up on this matter in approximately six months.”
Why it's significant

The report is significant because MCC handled tens of millions of dollars in grants during the audit period, including especially large recovery funding in fiscal year 2023.

“MCC received appropriations and grants of $84,831,610 in fiscal year 2023 and $32,928,445 in fiscal year 2024.”
Jargon, unpacked

A local cultural council is a city, town, or regional volunteer council that receives MCC money and awards it locally for arts, humanities, and science projects.

“According to MCC’s “Local Cultural Council Program Guidelines,” MCC will provide public funding for arts, humanities, and science programs or projects for any community in the Commonwealth, as long as the city or town has established a local cultural council (LCC).”

What the Auditor checked

What the Auditor found

The Massachusetts Cultural Council did not ensure that local cultural councils submitted required annual reports on time before funding decisions.
recordkeeping/documentationinternal controlsgrants managementreporting timeliness

Why it matters: Late or missing reporting increases the risk that public funds may be used for activities unrelated to arts, humanities, and sciences, and premature disbursement may allow funds to be used without proper accountability.

Standard: MCC’s fiscal years 2023 and 2024 “Local Cultural Council Program Guidelines” required LCCs to submit annual report components by specified deadlines and required MCC to review fundamental LCC operations before releasing funds. ( MCC’s fiscal years 2023 and 2024 “Local Cultural Council Program Guidelines” )

3 recommendations
  • MCC should ensure that LCCs comply with annual reporting requirements.
  • MCC should consistently assist all LCCs with recruiting and maintaining at least five active members, electing officers, and providing training to LCC members to help with the submission of annual reports until LCCs are at 100% compliance with submission deadlines.
  • MCC should ensure that disbursement of funds is made only after LCCs submit their annual reports.
Agency response & Auditor reply
Agency: "[MCC] ensures 100% of Local Cultural Councils are in full compliance with the program guidelines each year."
Auditor: "While MCC achieves compliance, we emphasize the importance of meeting reporting deadlines on time to ensure that public funds are not used for activities unrelated to arts, humanities, and sciences."
The Massachusetts Cultural Council did not ensure that all contractors with access to its grant management system completed cybersecurity awareness training.
cybersecurityinternal controlsdata privacyvendor oversight

Why it matters: Contractors without cybersecurity awareness training may expose sensitive data or MCC systems to malicious threats.

Standard: Executive Office of Technology Services and Security’s Information Security Risk Security Standard IS.010 required new hire and annual security awareness training for personnel. ( Executive Office of Technology Services and Security’s Information Security Risk Security Standard IS.010 )

2 recommendations
  • MCC should ensure that all contractors with access to its grant management system complete cybersecurity awareness training.
  • MCC should develop and implement monitoring controls to ensure that contractors complete the cybersecurity awareness training.
Agency response & Auditor reply
Agency: "We recognize the importance of ensuring that every individual with systems access including contractors completes formal cybersecurity awareness training."
Auditor: "Based on its response, MCC is taking measures to address our concerns regarding this matter."

More audits of this entity

Other Office of the State Auditor reports on Massachusetts Cultural Council .

See this entity's page with all 3 audits →