reliability of data used in this report for background or informational purposes was not assessed. MDTA’s management is responsible for establishing and maintaining effective internal control. Internal control is a process designed to provide reasonable assurance that objectives pertaining to the reliability of financial records; effectiveness and efficiency of operations, including safeguarding of assets; and compliance with applicable laws, rules, and regulations are achieved. As provided in Government Auditing Standards , there are five components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring. Each of the five components, when significant to the audit objectives, and as applicable to MDTA, were considered by us during the course of this audit. Because of inherent limitations in internal control, errors or fraud may nevertheless occur and not be detected. Also, projections of any evaluation of internal control to future periods are subject to the risk that conditions may change or compliance with policies and procedures may deteriorate. Our reports are designed to assist the Maryland General Assembly in exercising its legislative oversight function and to provide constructive recommendations for improving State operations. As a result, our reports generally do not address activities we reviewed that are functioning properly. This report includes findings related to conditions that we consider to be a significant deficiency in the design or operation of internal control that could adversely affect MDTA’s ability to maintain reliable financial records, operate effectively and efficiently, and/or comply with applicable laws, rules, and regulations. Our report also includes a finding regarding a significant instance of noncompliance with applicable laws, rules, or regulations. Other less significant findings were communicated to MDTA that did not warrant inclusion in this report. State Government Article Section 2-1224(i) requires that we redact in a manner consistent with auditing best practices any cybersecurity findings before a report is made available to the public. This results in the issuance of two different versions of an audit report that contains cybersecurity findings – a redacted version for the public and an unredacted version for government officials responsible for acting on our audit recommendations. The State Finance and Procurement Article, Section 3.5-301(c), states that cybersecurity is defined as “processes or capabilities wherein systems,
12
Made with FlippingBook - professional solution for displaying marketing and sales documents online