Audit of the Suffolk County Registry of Probate and Family Court (SCRPFC)

This is a Massachusetts State Auditor performance audit of how the Suffolk County Registry of Probate and Family Court handled e-filed court documents during the audit period.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the eFileMA system at the Suffolk County Registry of Probate and Family Court (SCRPFC) for the period September 1, 2018 through October 31, 2019.”

Auditors checked whether the registry processed electronic court filings according to specific Supreme Judicial Court rules.

“Does SCRPFC process documents in compliance with Sections 3(a)(1)(2), 3(b)(1), 4(d), and 8(c) of Supreme Judicial Court (SJC) Rule 1.25?”

The registry handles sensitive family and probate matters, so reliable document filing and cybersecurity practices affect people using the court system.

“Section 1 of Chapter 211B of the Massachusetts General Laws established the Probate and Family Court Department (PFCD), which has jurisdiction over probate and family matters such as divorce, paternity, child support, custody, visitation, adoption, termination of parental rights, and abuse prevention.”

If you file probate or family court documents electronically in Suffolk County, this audit says the tested e-filing process complied with the rules auditors reviewed.

“Below is our audit objective, indicating the question we intended our audit to answer and the conclusion we reached regarding the objective.”

The main audit result was clean for the tested e-filing rules, with a separate concern about cybersecurity training.

“In addition to concluding on our audit objective, we identified an issue we believe warrants SCRPFC’s attention, which we have disclosed in the “Other Matters” section of this report.”

The registry had already held a cybersecurity training, and auditors said it should consider making that training required for all staff when hired and every year after.

“While we believe that action was prudent, we also believe SCRPFC should consider adopting a policy that requires all of its staff members to receive cybersecurity awareness training upon hire and annually thereafter, which would bring it into line with the requirements for executive department agencies.”

Auditors warned that without regular cybersecurity training, the registry faces higher risk from cyberattacks and possible financial or reputational harm.

“In the Office of the State Auditor’s opinion, because SCRPFC does not require its employees, particularly those who have access to the Trial Court’s systems, to complete cybersecurity awareness training, there is an increased risk of cybersecurity attacks and financial and/or reputation losses.”

“eFileMA” is the online system people can use to open cases, file documents, get notices, and pay filing fees electronically.

“Eligible parties can use eFileMA to electronically send and receive specific case information, court documents, and court notices and to pay any applicable filing fees.”