The Fiscal Committee received the Legislative Budget Assistantoffice(LBA) management letter for the New Hampshire Liquor Commission's fiscal year 2024 audit on Sept. 5, which identified two material weaknesses and 11 additional internal control comments tied to the agencyimplementation of the NextGen system.

The findings matter because the commission operates retail outlets, state sales channels and related accounting functions whose controls affect state revenue and financial reporting. The LBA said inadequate planning and testing when NextGen went live contributed to material weaknesses and several significant deficiencies that the commission must address.

Jim LaRiviere, senior audit manager for the LBA, told the committee that when NextGen "went live, internal controls over the system had not been fully designed, developed, documented, or understood," and that management reports and key controls were not adequately planned or tested before operation. The management letter, LaRiviere said, contains 13 internal control comments; the first two are material weaknesses.

The report's recommendations include: expanding the commission's understanding of NextGen and creating a data dictionary; developing and documenting policies and procedures and key controls for transaction processes; investigating "phantom transactions" the system posted to New Hampshire First; establishing a formal risk assessment process for NextGen; reconciling NextGen accounts to New Hampshire First; designing daily cash receipt controls that document reconciliation to bank deposits; maintaining subsidiary ledgers for receivables and payables; and improving lease accounting consistent with Governmental Accounting Standards Board standards.

The letter also recommended the commission consider obtaining system organization controls (SOC) reports for outsourced third-party services to better understand controls over IT, data security and financial reporting. The commission disagreed with that SOC recommendation, the LBA said, noting the commission cited alternative vendor risk practices; the LBA responded that alternatives may not fully address the benefits of SOC reports for identifying financial reporting risk. The Department of Administrative Services agreed to work with the commission on contract language and potential SOC requirements.

Commissioner Mulligan and Liquor Commission staff acknowledged the new system had replaced a 40-year legacy platform shortly before the audit. Mulligan said the commission would remediate identified problems: "When there is a problem, we remediate it and we'll continue to do so." Dennis Goulet, commissioner of the Department of Information Technology, told members that NextGen is not a statewide standard and that liquor's implementation had specific point-of-sale requirements not replicated across most agencies.

The report also noted that of nine prior comments from fiscal 2022 and 2023, five had been fully resolved and four remained in remediation. The LBA presentation closed by asking the commission to provide estimated completion dates for remediation items; committee members pressed for tracking of completion dates and reschedules so the committee can review progress on outstanding audit actions.

Committee leadership said the report would be placed on file in the usual manner. No legislative action was recommended by the LBA in the management letter.