Massachusetts Commission Against Discrimination
June 29, 2016 · Read the full official report (PDF) ↗ · official site ↗
Published June 29, 2016 Audit covers July 1, 2012 – June 30, 2014 Under Suzanne M. Bump · 2011–2023
source
“Below is a summary of our findings and recommendations, with links to each page listed.”
Read the plain-English breakdown
This is a state performance audit of the Massachusetts Commission Against Discrimination, the state agency that handles discrimination complaints.
“I am pleased to provide this performance audit of the Massachusetts Commission Against Discrimination.”
Auditors reviewed whether MCAD handled cases efficiently and legally, managed money and payroll properly, reported correctly, and had an effective advisory board.
“This audit was undertaken to determine whether MCAD’s case-management process operated efficiently and effectively and complied with applicable laws and regulations; to determine whether MCAD properly administered certain activities related to revenue, expenses, payroll, budgeting, and legislative reporting; and to assess the activities of MCAD’s advisory board.”
If discrimination cases are delayed, people accused of discrimination may not face consequences quickly, and people who filed complaints may have to turn to more expensive court options.
“Not completing discrimination cases within regulatory timeframes allows potential perpetrators of discrimination to go unpunished for extended periods.”
For an ordinary resident, this matters because MCAD is supposed to protect people from discrimination in jobs, housing, education, credit, and public places.
“It is responsible for enforcing the state’s antidiscrimination laws in the areas of employment, housing, public accommodations, credit, and access to education.”
Auditors found MCAD often missed required investigation timelines, did not consistently meet case completion goals, could not properly support some penalty collections, and had weaknesses in security, emergency planning, internal controls, payroll, and personnel records.
“MCAD did not always complete investigations within regulatory timeframes.”
The report recommended that MCAD improve case handling, revenue tracking, security controls, emergency planning, internal controls, payroll procedures, and personnel-file documentation.
“MCAD should perform an assessment of its current resources and investigation practices and identify opportunities to make its investigation process more efficient.”
MCAD had thousands of open cases and handled more than 3,000 new complaints each year, so delays and weak controls could affect many people across Massachusetts.
“According to its annual reports, MCAD responds to more than 3,000 new complaint filings per year.”
The report uses terms like “substantive disposition,” which means MCAD decided whether there was probable cause or not in a complaint.
“Substantive disposition of a complaint is the finding of either probable cause or lack of probable cause.”
What the Auditor checked
- Did not comply Did MCAD investigate and close all discrimination complaints in a timely manner and in accordance with established laws and regulations?
- Did not comply Did MCAD’s investigators meet the case-management policy performance goals established for case processing and resolution?
- Did not comply Are MCAD’s internal controls over revenue effective in ensuring that receipts are adequately safeguarded?
- Did not comply Are effective system access controls in place over the CMS?
- Complied Did MCAD comply with (1) state budget authorizations and federal program guidelines regarding retained revenue and related expenses and (2) state budget legislative reporting responsibilities?
- Did not comply Does MCAD’s internal control plan (ICP) comply with the guidelines of the Office of the State Comptroller (OSC), and was its ICQ filed properly with OSC?
- Did not comply Are MCAD’s internal controls over payroll effective in ensuring payroll accuracy?
- Complied Are operations-related administrative expenses reasonable, properly supported, and recorded in the state’s Massachusetts Management Accounting and Reporting System (MMARS)?
- Did not comply Did MCAD comply with the requirement of having an effective Advisory Board?
What the Auditor found
Why it matters: Potential perpetrators of discrimination may go unpunished for extended periods, and alleged victims may seek resolution through a more costly judicial process.
Standard: 804 CMR 1.13(3), 804 CMR 1.10(2), and 804 CMR 1.02 ( 804 CMR 1.13(3); 804 CMR 1.10(2) )
2 recommendations
- MCAD should assess its resources and investigation practices and identify opportunities to make its investigation process more efficient.
- If MCAD believes mandatory mediation would expedite complaints, it should take steps to implement that change.
Agency response & Auditor reply
Agency: "Inadequate staffing makes it impracticable to meet the 18-month requirement."
Auditor: "Although we are encouraged by MCAD’s initiatives to improve operating efficiencies, we disagree with its assertion that its regulations requiring case closure in 18 months were intended to be “only an ambitious goal.”"
Why it matters: MCAD may be unable to manage investigations effectively, reduce its backlog, and process cases within established timeframes.
Standard: MCAD management directive requiring at least eight substantive case closures per month for non-housing cases and at least seven per month for housing cases.
3 recommendations
- MCAD should develop and implement monitoring controls to ensure investigators meet the monthly substantive case completion requirement.agency: already implemented
- MCAD should consider formally making the case completion requirement part of investigators’ evaluations.
- MCAD should consider assigning each case to the person who performed its initial intake evaluation.agency: disagreed
Agency response & Auditor reply
Agency: "The concerns of this finding have been addressed."
Auditor: "Based on its response, MCAD is taking appropriate measures to address our concerns, including implementing accountability standards for case investigators’ monthly production requirements."
Why it matters: The Commonwealth may not receive penalties in a timely manner, financial records may be inaccurate, and people assessed penalties may not be held fully accountable.
Standard: Office of the State Comptroller Cash Recognition and Reconciliation Policy, Receivable Recognition and Reconciliation Policy, and Delinquent Debt Cycle Policy. ( OSC Cash Recognition and Reconciliation Policy; OSC Receivable Recognition and Reconciliation Policy; OSC Delinquent Debt Cycle Policy )
4 recommendations
- MCAD should implement policies and procedures for collection, recording, reporting, and reconciliation of revenue.
- All revenue-administration personnel should be fully trained and adequately supervised.
- MCAD’s internal control plan should include revenue processing, reconciliation, and supervisory controls.
- MCAD’s Fiscal Office should perform monthly revenue reconciliations among MCAD records, bank statements, and MMARS reports.
Agency response & Auditor reply
Agency: "Records kept by the Clerk’s Office recording civil penalties reveal that during the audit period (7/1/12 through 6/30/14) $90,000 in civil penalties was imposed in Single Hearing Officer Orders."
Auditor: "In total, our examination indicated that $377,000 in civil penalty fees either had been not collected or, if they were collected, had not been properly classified or recorded."
Why it matters: Sensitive data in MCAD’s case-management database was at high risk of unauthorized access or improper disclosure.
Standard: MassIT Enterprise Information Security Policy ( MassIT Enterprise Information Security Policy )
3 recommendations
- MCAD should remove user accounts for individuals who no longer need CMS access and periodically verify authorized users and access levels.agency: already implemented
- MCAD should establish formal system security access policies and procedures consistent with MassIT policies.
- MCAD should designate a security officer to manage IT security activities, prepare an ESP, and maintain an ISP.
Agency response & Auditor reply
Agency: "The concerns of this finding have been addressed."
Auditor: "However, because its written response did not specifically address the establishment of formal system access security policies and procedures and the designation of a security administrator, we continue to recommend that MCAD take these actions."
Why it matters: MCAD could be delayed in restoring mission-critical, essential, and confidential functions and data after a disruption.
Standard: MassIT Enterprise Information Security Policy ( MassIT Enterprise Information Security Policy )
2 recommendations
- MCAD should confer with MassIT for guidance in developing continuity-of-operations and disaster-recovery plans.agency: already implemented
- MCAD should test the plans, train staff periodically, and store secure offsite copies.
Agency response & Auditor reply
Agency: "The concerns of this finding have been addressed."
Auditor: "Based on its response, we believe MCAD is taking measures to address the concerns we identified."
Why it matters: MCAD may not achieve its mission and objectives effectively, efficiently, and in compliance with applicable requirements, and OSC cannot effectively assess MCAD’s internal controls for financial reporting.
Standard: OSC Internal Control Guide and COSO enterprise risk management framework ( 2007 OSC Internal Control Guide; COSO Enterprise Risk Management—Integrated Framework )
2 recommendations
- MCAD should ensure annual ICQs submitted to OSC are accurate and complete.
- MCAD should retain printed, approver-signed ICQ certification copies.
Agency response & Auditor reply
Agency: "The concerns of this finding are currently under review and are being addressed."
Auditor: "However, MCAD did not specifically address our concerns regarding the accuracy and representation certifications made on the annual ICQs submitted during our audit period."
Why it matters: MCAD could not assure that all weekly time and attendance records were accurate and properly approved, and may not be able to resolve personnel disputes adequately.
Standard: OSC Payroll Approval: Payroll Expenditure Approval Policy, Section 52C of Chapter 149 of the Massachusetts General Laws, and the Commonwealth’s Records Retention Policy. ( OSC Payroll Approval: Payroll Expenditure Approval Policy; Section 52C of Chapter 149 of the Massachusetts General Laws; Commonwealth’s Records Retention Policy, Section E4(5) and Section E5(3) )
3 recommendations
- MCAD should establish and implement a standardized time-reporting process or use the Commonwealth’s SSTA system.agency: already implemented
- MCAD should establish payroll policies and procedures that adhere to OSC policies and monitor compliance.
- MCAD should develop policies and procedures to ensure required documentation is present in each personnel file.
Agency response & Auditor reply
Agency: "The concerns of this finding have been addressed."
Auditor: "Based on its response, we believe that MCAD is taking appropriate measures to address the concerns we identified."
Verified dollar findings
Money the entity was owed but failed to assess or collect - unassessed penalties, underpaid incentives.
More audits of this entity
Other Office of the State Auditor reports on Massachusetts Commission Against Discrimination .
- Audit of the Massachusetts Commission Against DiscriminationAuthority / Commission · April 4, 2022