Audit 10648

2023-001 – Subrecipient Information and Monitoring Grantor: Centers for Disease Control and Prevention (CDC) Passthrough Agency: Massachusetts Department of Public Health Program Name: Massachusetts Community Health Worker for Resilience Award Name: Community Health Workers for Public Health Response and Resilient Award Year: Various Award Number: INTF4207M03225031012 Assistance Listing Number: 93.495 Criteria The Uniform Guidance states that: a pass-through entity (PTE) must • Identify the Award and Applicable Requirements including clearly identify information to the subrecipient. • Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). • Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). Condition Through our testing of the subrecipient information and monitoring at the Alliance over the Massachusetts Community Health Worker for Resilience program, we selected four organizations to whom the Alliance passed federal funding through to during fiscal year 2023. For each of the four selections, the entity was not able to evidence that they provided all required information to subrecipients at the time of the subaward (or subsequent subaward modification), as per the OMB compliance supplement requirements. Specifically, as per the review of the sub-award agreement, we were not able to verify the below information was communicated to the subrecipient at the time of the execution of the subaward agreement: i) Sub-recipient's Unique Identity Number ii) The entity's Federal Award Identification Number iii) Name of Federal awarding agency iv) Contact information for awarding officials of CHA v) Assistance Listing Number and Title vi) Indirect cost rate for the Federal award In addition, it was noted that documentation of a risk assessment being performed prior to entering into the subcontract was not available for the four selections and there was no formal documentation of subsequent subrecipient monitoring. There was also no evidence of review of uniform guidance reports. Cause The Alliance has policies in place for subrecipient monitoring that address the communication of award information to the subrecipient, risk assessments and continued monitoring but due to lack of training and understanding, those policies were not executed properly on this award. Effect There was a lack of communication to the subrecipient regarding the subaward agreement. The lack of formal documentation of initial risk does not allow the Alliance to ensure consistency in their risk assessments of subrecipients nor does it allow for a formal annual reassessment of risk and a clear linking of these assessments to the level of subsequent subrecipient monitoring. Questioned Costs None noted. Recommendation We recommend the Alliance implement training and a template to be utilized for the communication of the subaward information as well as an initial risk assessment and a continuing reassessment. In addition to these tools, we recommend the Alliance consider the following: • Formalize procedures to communicate the subaward information to the subrecipient • Implementing a formal review of the initial assessment prior to entering into the agreement as well as continuing subrecipient risk reassessments, including review of Uniform Guidance Reports • Formalizing the monitoring that is expected when a subrecipient is categorized as high versus low risk and the departments/individuals responsible for such monitoring • Formalize the annual subrecipient risk assessment process and the criteria to be reviewed and ensure it includes all subrecipients. Input into this assessment should be obtained from various constituents, including the Key Personnel. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings.

2023-001 – Subrecipient Information and Monitoring Grantor: Centers for Disease Control and Prevention (CDC) Passthrough Agency: Massachusetts Department of Public Health Program Name: Massachusetts Community Health Worker for Resilience Award Name: Community Health Workers for Public Health Response and Resilient Award Year: Various Award Number: INTF4207M03225031012 Assistance Listing Number: 93.495 Criteria The Uniform Guidance states that: a pass-through entity (PTE) must • Identify the Award and Applicable Requirements including clearly identify information to the subrecipient. • Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). • Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). Condition Through our testing of the subrecipient information and monitoring at the Alliance over the Massachusetts Community Health Worker for Resilience program, we selected four organizations to whom the Alliance passed federal funding through to during fiscal year 2023. For each of the four selections, the entity was not able to evidence that they provided all required information to subrecipients at the time of the subaward (or subsequent subaward modification), as per the OMB compliance supplement requirements. Specifically, as per the review of the sub-award agreement, we were not able to verify the below information was communicated to the subrecipient at the time of the execution of the subaward agreement: i) Sub-recipient's Unique Identity Number ii) The entity's Federal Award Identification Number iii) Name of Federal awarding agency iv) Contact information for awarding officials of CHA v) Assistance Listing Number and Title vi) Indirect cost rate for the Federal award In addition, it was noted that documentation of a risk assessment being performed prior to entering into the subcontract was not available for the four selections and there was no formal documentation of subsequent subrecipient monitoring. There was also no evidence of review of uniform guidance reports. Cause The Alliance has policies in place for subrecipient monitoring that address the communication of award information to the subrecipient, risk assessments and continued monitoring but due to lack of training and understanding, those policies were not executed properly on this award. Effect There was a lack of communication to the subrecipient regarding the subaward agreement. The lack of formal documentation of initial risk does not allow the Alliance to ensure consistency in their risk assessments of subrecipients nor does it allow for a formal annual reassessment of risk and a clear linking of these assessments to the level of subsequent subrecipient monitoring. Questioned Costs None noted. Recommendation We recommend the Alliance implement training and a template to be utilized for the communication of the subaward information as well as an initial risk assessment and a continuing reassessment. In addition to these tools, we recommend the Alliance consider the following: • Formalize procedures to communicate the subaward information to the subrecipient • Implementing a formal review of the initial assessment prior to entering into the agreement as well as continuing subrecipient risk reassessments, including review of Uniform Guidance Reports • Formalizing the monitoring that is expected when a subrecipient is categorized as high versus low risk and the departments/individuals responsible for such monitoring • Formalize the annual subrecipient risk assessment process and the criteria to be reviewed and ensure it includes all subrecipients. Input into this assessment should be obtained from various constituents, including the Key Personnel. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings.