Audit 302106

Special Tests and Provisions Material Weakness in Internal Control over Compliance and Material Noncompliance Research and Development Cluster Criteria: The Organization is required to maintain controls to ensure compliance with the terms of the contracts and/or grants which it negotiated with the federal government and is required to comply with the terms of the contract or grant agreements. Condition: Two (2) of the four (4) contracts selected for testing contained a key personnel provision in the contract. The key person was not required to work a specified amount of hours, but the Organization was required to inform the Contracting Officer regarding any changes to the key personnel listing. During the period of the contracts with these provisions, the Organization did not have a control structure in place to monitor compliance with these key personnel provisions. Consequently, for one (1) of the contracts that contained a key personnel provision, the identified key person was removed from the contract and not replaced. The Contracting Officer was not informed of this change. Cause: The Organization did not have controls in place to monitor compliance with the key personnel provisions. Effect or potential effect: The Organization did not comply therefore with the provisions of the contract. Questioned costs: None. Context: Our sample was not intended to be statistically valid. Recommendation: The Organization should incorporate a step in their contract review process that identifies any key personnel requirements. The Organization should discuss with the Contracting Officer prior to signing the contract the reasonableness of the provision. Additionally, for any key personnel provisions in contracts negotiated with the federal government, the Organization should ensure that it has controls in place to monitor compliance with these provisions. This control apparatus should include regular review of the Organization’s compliance with these provisions and documented instances of noncompliance should be communicated to the Contracting Officer as soon as practicable. Views of responsible officials and planned corrective actions: Management's response is reported in "Management's Views and Corrective Action Plan" included at the end of this report. Identification of prior year finding: 2021-004

Material Weakness in Internal Control over Compliance and Material Noncompliance Research and Development Cluster Criteria: Non-federal entities other than states must follow the procurement standards set out at 2 CFR 200.318 through 200.326. They must use their own documented procedures, which reflect applicable state and local laws and regulations, provided that the procurement standards conform to the applicable federal statutes and the procurement requirements identified in 2 CFR part 200. Condition: The Organization has a procurement policy in place; however, the Organization is not consistently following the procurement policy. During the period of the contracts with these provisions, the Organization did not have a control structure in place to monitor compliance with procurement requirements. Consequently, for four (4) of four (4) contracts tested, the procurement policy was not followed and no documentation to reflect compliance with Uniform Guidance requirements related to procurement could be provided. Cause: The Organization did not have proper controls in place to monitor compliance with the procurement. Effect or potential effect: The procurement policy retained by the Organization has not been updated to confirm to the Organization’s current operations. The Organization could become noncompliant with the requirements of the Uniform Guidance, resulting in findings and questioned costs related to dollar amounts being expended to vendors. Additionally, the Organization could become ineligible to receive funds from federal entities or may have to issue refunds to federal entities. Questioned costs: None. Context: Our sample was not intended to be statistically valid. Recommendation: The Organization should update its procurement policy to reflect current operations. Additionally, the Organization should review the current procurement operations in conjunction with the review of the procurement policies to ensure that all practices and policies conform to the standards promulgated by the CFR. Views of responsible officials and planned corrective actions: Management's response is reported in "Management's Views and Corrective Action Plan" included at the end of this report. Identification of prior year finding: 2021-005

Material Weakness in Internal Control over Subrecipient Monitoring and Material Noncompliance Research and Development Cluster Criteria: In accordance with 2 CFR 200.331, a pass-through entity must make a case-by-case determination whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Additionally, in accordance with 2 CFR 200.332(b), the pass-through entity must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. In furtherance of this, the pass-through entity should inquire as to whether or not the subrecipient was subject to a Single Audit. If the subrecipient was subject to a Single Audit, the pass-through entity must request the Single Audit report and review for any findings or questioned costs. In accordance with 2 CFR 200.521, the pass-through entity should issue a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity as applicable. Condition: The Organization does not document its evaluation of each party that it engages in business with as to whether they are a contractor or a subrecipient. For three (3) of the three (3) such parties selected for testing, the Organization did not maintain documentation regarding whether the entity was a subrecipient or a contractor. Furthermore, as it relates to the monitoring of entities determined to be subrecipients, the Organization has not formally documented its subrecipient monitoring procedures to ensure that subrecipients are in compliance with federal statutes, regulations, and the terms and conditions of the subawards. For three (3) of the three (3) subrecipients selected for testing, the Organization did not inquire as to whether the entity was subject to a Single Audit. Consequently, the Organization did not request the Single Audit report nor did they review them for any findings pertinent to the federal award provided to the subrecipient from the pass-through entity. Cause: The Organization did not have an effective process in place to determine whether entities receiving pass-through funds are subrecipients or contractors. However, it was noted that the Organization implemented a process during the year to properly document whether a company is a contractor or a subrecipient. Furthermore, once that determination has been made, the Organization did not have a process in place for evaluating subrecipients and their compliance with the applicable requirements of the Uniform Guidance. Effect or potential effect: Lack of proper consideration of subrecipient or contractor status may result in the Organization improperly classifying a recipient of federal funds, which may impact the recipient’s compliance with the Uniform Guidance. Furthermore, by not performing adequate monitoring over subrecipients, the Organization is not appropriately monitoring whether subrecipients are in compliance with grant requirements. Questioned costs: None. Context: Our sample was not intended to be statistically valid. Recommendation: The Organization should have instituted a process whereby all entities that receive federal funds have proper documentation supporting their classification as a subrecipient or a contractor for the entire year. Additionally, the Organization should maintain a standardized checklist for all such entities that support their rationale for the classification. This checklist should be prepared by an employee with knowledge of the grant and approved by a second individual. Furthermore, as it relates to subrecipient monitoring, the Organization should institute an annual process whereby all subrecipients are asked whether they received a Single Audit. If the subrecipient was subject to a Single Audit, the Organization should receive and review the Single Audit report. The reviewer should submit a memorandum of any findings relevant to their federal grant, which should then be submitted to the project manager or other designated person for approval. Views of responsible officials and planned corrective actions: Management's response is reported in "Management's Views and Corrective Action Plan" included at the end of this report. Identification of prior year finding: 2021-006

Special Tests and Provisions Material Weakness in Internal Control over Compliance and Material Noncompliance Research and Development Cluster Criteria: The Organization is required to maintain controls to ensure compliance with the terms of the contracts and/or grants which it negotiated with the federal government and is required to comply with the terms of the contract or grant agreements. Condition: Two (2) of the four (4) contracts selected for testing contained a key personnel provision in the contract. The key person was not required to work a specified amount of hours, but the Organization was required to inform the Contracting Officer regarding any changes to the key personnel listing. During the period of the contracts with these provisions, the Organization did not have a control structure in place to monitor compliance with these key personnel provisions. Consequently, for one (1) of the contracts that contained a key personnel provision, the identified key person was removed from the contract and not replaced. The Contracting Officer was not informed of this change. Cause: The Organization did not have controls in place to monitor compliance with the key personnel provisions. Effect or potential effect: The Organization did not comply therefore with the provisions of the contract. Questioned costs: None. Context: Our sample was not intended to be statistically valid. Recommendation: The Organization should incorporate a step in their contract review process that identifies any key personnel requirements. The Organization should discuss with the Contracting Officer prior to signing the contract the reasonableness of the provision. Additionally, for any key personnel provisions in contracts negotiated with the federal government, the Organization should ensure that it has controls in place to monitor compliance with these provisions. This control apparatus should include regular review of the Organization’s compliance with these provisions and documented instances of noncompliance should be communicated to the Contracting Officer as soon as practicable. Views of responsible officials and planned corrective actions: Management's response is reported in "Management's Views and Corrective Action Plan" included at the end of this report. Identification of prior year finding: 2021-004

Material Weakness in Internal Control over Compliance and Material Noncompliance Research and Development Cluster Criteria: Non-federal entities other than states must follow the procurement standards set out at 2 CFR 200.318 through 200.326. They must use their own documented procedures, which reflect applicable state and local laws and regulations, provided that the procurement standards conform to the applicable federal statutes and the procurement requirements identified in 2 CFR part 200. Condition: The Organization has a procurement policy in place; however, the Organization is not consistently following the procurement policy. During the period of the contracts with these provisions, the Organization did not have a control structure in place to monitor compliance with procurement requirements. Consequently, for four (4) of four (4) contracts tested, the procurement policy was not followed and no documentation to reflect compliance with Uniform Guidance requirements related to procurement could be provided. Cause: The Organization did not have proper controls in place to monitor compliance with the procurement. Effect or potential effect: The procurement policy retained by the Organization has not been updated to confirm to the Organization’s current operations. The Organization could become noncompliant with the requirements of the Uniform Guidance, resulting in findings and questioned costs related to dollar amounts being expended to vendors. Additionally, the Organization could become ineligible to receive funds from federal entities or may have to issue refunds to federal entities. Questioned costs: None. Context: Our sample was not intended to be statistically valid. Recommendation: The Organization should update its procurement policy to reflect current operations. Additionally, the Organization should review the current procurement operations in conjunction with the review of the procurement policies to ensure that all practices and policies conform to the standards promulgated by the CFR. Views of responsible officials and planned corrective actions: Management's response is reported in "Management's Views and Corrective Action Plan" included at the end of this report. Identification of prior year finding: 2021-005

Material Weakness in Internal Control over Subrecipient Monitoring and Material Noncompliance Research and Development Cluster Criteria: In accordance with 2 CFR 200.331, a pass-through entity must make a case-by-case determination whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. Additionally, in accordance with 2 CFR 200.332(b), the pass-through entity must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. In furtherance of this, the pass-through entity should inquire as to whether or not the subrecipient was subject to a Single Audit. If the subrecipient was subject to a Single Audit, the pass-through entity must request the Single Audit report and review for any findings or questioned costs. In accordance with 2 CFR 200.521, the pass-through entity should issue a management decision for audit findings pertaining to the federal award provided to the subrecipient from the pass-through entity as applicable. Condition: The Organization does not document its evaluation of each party that it engages in business with as to whether they are a contractor or a subrecipient. For three (3) of the three (3) such parties selected for testing, the Organization did not maintain documentation regarding whether the entity was a subrecipient or a contractor. Furthermore, as it relates to the monitoring of entities determined to be subrecipients, the Organization has not formally documented its subrecipient monitoring procedures to ensure that subrecipients are in compliance with federal statutes, regulations, and the terms and conditions of the subawards. For three (3) of the three (3) subrecipients selected for testing, the Organization did not inquire as to whether the entity was subject to a Single Audit. Consequently, the Organization did not request the Single Audit report nor did they review them for any findings pertinent to the federal award provided to the subrecipient from the pass-through entity. Cause: The Organization did not have an effective process in place to determine whether entities receiving pass-through funds are subrecipients or contractors. However, it was noted that the Organization implemented a process during the year to properly document whether a company is a contractor or a subrecipient. Furthermore, once that determination has been made, the Organization did not have a process in place for evaluating subrecipients and their compliance with the applicable requirements of the Uniform Guidance. Effect or potential effect: Lack of proper consideration of subrecipient or contractor status may result in the Organization improperly classifying a recipient of federal funds, which may impact the recipient’s compliance with the Uniform Guidance. Furthermore, by not performing adequate monitoring over subrecipients, the Organization is not appropriately monitoring whether subrecipients are in compliance with grant requirements. Questioned costs: None. Context: Our sample was not intended to be statistically valid. Recommendation: The Organization should have instituted a process whereby all entities that receive federal funds have proper documentation supporting their classification as a subrecipient or a contractor for the entire year. Additionally, the Organization should maintain a standardized checklist for all such entities that support their rationale for the classification. This checklist should be prepared by an employee with knowledge of the grant and approved by a second individual. Furthermore, as it relates to subrecipient monitoring, the Organization should institute an annual process whereby all subrecipients are asked whether they received a Single Audit. If the subrecipient was subject to a Single Audit, the Organization should receive and review the Single Audit report. The reviewer should submit a memorandum of any findings relevant to their federal grant, which should then be submitted to the project manager or other designated person for approval. Views of responsible officials and planned corrective actions: Management's response is reported in "Management's Views and Corrective Action Plan" included at the end of this report. Identification of prior year finding: 2021-006