Community Economic Development Assistance Corporation

Auditors reviewed whether CEDAC had proper controls over its loan process, including whether loans followed rules, were monitored, protected state funds, and supported the agency’s mission.

“The objective of our audit was to review certain aspects of CEDAC’s administration of its lending process to determine whether it had established adequate controls over this process to ensure that (1) loans were being provided in accordance with established guidelines, (2) its loan portfolio was being effectively monitored for performance and desired outcomes, (3) state funds were being properly safeguarded, and (4) the rate of loan defaults and the return on investment for loans were adequate to support CEDAC’s continued operations and accomplishment of its mission.”

CEDAC handles public-facing economic development work and affordable housing lending, so the public needs transparency about whether it is meeting goals and managing risks.

“Because CEDAC did not file this annual plan, it did not provide the Commonwealth or the public with the transparency necessary to determine how effectively it was meeting its organizational goals and objectives.”

For residents, this matters because CEDAC helps finance affordable housing development and housing for people with special needs or disabilities.

“HIF loans support affordable housing projects such as limited equity cooperatives,2 single-room-occupancy housing, and housing for special-needs residents.”

The lending program largely checked out, but CEDAC needed to improve compliance and internal planning by filing annual plans and documenting risk controls.

“However, we found that CEDAC did not file an annual plan with OPMO as required by law.”

CEDAC agreed to start filing its annual plan and later filed its fiscal year 2015 plan with OPMO.

“CEDAC officially filed its fiscal year 2015 annual plan with OPMO on June 9, 2014.”

The report is significant because it says the core loan work appeared sound, but CEDAC’s oversight paperwork had gaps that could weaken accountability if not fixed.

“Its lack of a department-wide risk assessment, with cross-references of risks to controls established to mitigate them, may hinder or prevent it from fulfilling its responsibilities, achieving its goals and objectives, and ensuring the integrity and effectiveness of its internal control system.”

A risk assessment means identifying what could go wrong and matching those risks to controls that reduce them.

“A risk assessment is an integral part of an entity’s internal control process because it identifies and analyzes risks and assists management in prioritizing the activities where controls are most needed to mitigate risk.”