CURRENT YEAR FINDINGS 2023-001 Significant deficiency – Procurement of Subcontractors, Significant Deficiency in Internal Controls over Compliance, and Instances of Noncompliance. Criteria: The organization is required by the terms and conditions of the grant agreement with the Department of State, that prior to signing a sub award, including a consultant or contractor agreement, the recipient must submit vetting information to the Office of Risk Analysis Management (RAM) and receive written notification of that sub-recipient’s, consultant, or contractors’ eligibility. Condition and Context: Per review of the Organization’s subcontractor and consulting agreements, we were not provided sufficient evidence that the organization completed the vetting process for 2 of the 7 tested. Effect: Federal funds could be expended to contractors that may not use the funds appropriately. In addition, the Organization could unknowingly fund an enemy of the Untied States. Cause: Contracts were signed, and funds were expended to subcontractors without the proper vetting being completed. Recommendation: We recommend not entering into any agreements or releasing funds paid for by federal grants before the completion of the vetting process, as described by the grant agreement. Managements response: Beginning in early 2023, the Organization implemented a new vetting monitoring system and procedure. All contractors and employees submitted for hire by the Program Managers, or the Executive Director, are referred via a Job Proposal automated task document approval to the Managing Director. The Managing Director is the agreed-upon point of contact with the federal agency to determine if the proposed new hire needs to be vetted based on the criteria set by the federal agency. If the Managing Director deems necessary that the hire needs to be vetted, a vetting task and confirmation of receipt are sent by the system to the Operations Associate. The Operations Associate oversees maintaining the RAM system and submitting new vetting requests. Once the vetting has been approved or declined, the Operations Associate enters the information into U4I’s relational database, and only at this point can the hiring process move forward, provided RAM approves the vetting. The new system has automated alarm notifications and emails monthly reports based on the “date of last vetting,” calculating the “date of new vetting” automatically for a list of over 85 employees and contractors. Case 1 - In the case of the first vetting issue, there was a staff transition in the Managing Director’s position and the vetting process was not carried out as described above. There was a gap in filling the responsibility attached to this role. Remedy - We have introduced a backup Vetting POC in our vetting process moving forward to prevent this type of occurrence during transitions. If the Managing Director is unavailable, and a confirmation of the vetting task is not received, the Co-Director acting as interim Vetting POC will be asked to assume the role and evaluate the hires and vetting. Case 2 - In the case of the second vetting issue, we could not find any records of evidence in RAM that vetting ever happened, which is an oversight of internal controls. It is possible that the close relationship of many years between the U4I leadership and this company led to overconfidence and a loosening of normal internal controls. It is also possible that since the contractor is a SAM-registered Canadian company also operating in the USA and receiving federal wards, the management considered the vetting procedure unnecessary. We could not consult the individual that was in that vetting POC role at the time as she is no longer working with U4I. Remedy - The FIN/OPS team overseeing the new vetting procedure and added control steps, will make sure that all vendors, contractors and employees, without exclusions and regardless of any subjective levels of mutual trust and regardless the length of existing relationships, are run through the Job Proposal and Vetting Procedure and that the contractual process will be stopped unless there is a RAM record to consider the hire.
CURRENT YEAR FINDINGS 2023-001 Significant deficiency – Procurement of Subcontractors, Significant Deficiency in Internal Controls over Compliance, and Instances of Noncompliance. Criteria: The organization is required by the terms and conditions of the grant agreement with the Department of State, that prior to signing a sub award, including a consultant or contractor agreement, the recipient must submit vetting information to the Office of Risk Analysis Management (RAM) and receive written notification of that sub-recipient’s, consultant, or contractors’ eligibility. Condition and Context: Per review of the Organization’s subcontractor and consulting agreements, we were not provided sufficient evidence that the organization completed the vetting process for 2 of the 7 tested. Effect: Federal funds could be expended to contractors that may not use the funds appropriately. In addition, the Organization could unknowingly fund an enemy of the Untied States. Cause: Contracts were signed, and funds were expended to subcontractors without the proper vetting being completed. Recommendation: We recommend not entering into any agreements or releasing funds paid for by federal grants before the completion of the vetting process, as described by the grant agreement. Managements response: Beginning in early 2023, the Organization implemented a new vetting monitoring system and procedure. All contractors and employees submitted for hire by the Program Managers, or the Executive Director, are referred via a Job Proposal automated task document approval to the Managing Director. The Managing Director is the agreed-upon point of contact with the federal agency to determine if the proposed new hire needs to be vetted based on the criteria set by the federal agency. If the Managing Director deems necessary that the hire needs to be vetted, a vetting task and confirmation of receipt are sent by the system to the Operations Associate. The Operations Associate oversees maintaining the RAM system and submitting new vetting requests. Once the vetting has been approved or declined, the Operations Associate enters the information into U4I’s relational database, and only at this point can the hiring process move forward, provided RAM approves the vetting. The new system has automated alarm notifications and emails monthly reports based on the “date of last vetting,” calculating the “date of new vetting” automatically for a list of over 85 employees and contractors. Case 1 - In the case of the first vetting issue, there was a staff transition in the Managing Director’s position and the vetting process was not carried out as described above. There was a gap in filling the responsibility attached to this role. Remedy - We have introduced a backup Vetting POC in our vetting process moving forward to prevent this type of occurrence during transitions. If the Managing Director is unavailable, and a confirmation of the vetting task is not received, the Co-Director acting as interim Vetting POC will be asked to assume the role and evaluate the hires and vetting. Case 2 - In the case of the second vetting issue, we could not find any records of evidence in RAM that vetting ever happened, which is an oversight of internal controls. It is possible that the close relationship of many years between the U4I leadership and this company led to overconfidence and a loosening of normal internal controls. It is also possible that since the contractor is a SAM-registered Canadian company also operating in the USA and receiving federal wards, the management considered the vetting procedure unnecessary. We could not consult the individual that was in that vetting POC role at the time as she is no longer working with U4I. Remedy - The FIN/OPS team overseeing the new vetting procedure and added control steps, will make sure that all vendors, contractors and employees, without exclusions and regardless of any subjective levels of mutual trust and regardless the length of existing relationships, are run through the Job Proposal and Vetting Procedure and that the contractual process will be stopped unless there is a RAM record to consider the hire.
CURRENT YEAR FINDINGS 2023-001 Significant deficiency – Procurement of Subcontractors, Significant Deficiency in Internal Controls over Compliance, and Instances of Noncompliance. Criteria: The organization is required by the terms and conditions of the grant agreement with the Department of State, that prior to signing a sub award, including a consultant or contractor agreement, the recipient must submit vetting information to the Office of Risk Analysis Management (RAM) and receive written notification of that sub-recipient’s, consultant, or contractors’ eligibility. Condition and Context: Per review of the Organization’s subcontractor and consulting agreements, we were not provided sufficient evidence that the organization completed the vetting process for 2 of the 7 tested. Effect: Federal funds could be expended to contractors that may not use the funds appropriately. In addition, the Organization could unknowingly fund an enemy of the Untied States. Cause: Contracts were signed, and funds were expended to subcontractors without the proper vetting being completed. Recommendation: We recommend not entering into any agreements or releasing funds paid for by federal grants before the completion of the vetting process, as described by the grant agreement. Managements response: Beginning in early 2023, the Organization implemented a new vetting monitoring system and procedure. All contractors and employees submitted for hire by the Program Managers, or the Executive Director, are referred via a Job Proposal automated task document approval to the Managing Director. The Managing Director is the agreed-upon point of contact with the federal agency to determine if the proposed new hire needs to be vetted based on the criteria set by the federal agency. If the Managing Director deems necessary that the hire needs to be vetted, a vetting task and confirmation of receipt are sent by the system to the Operations Associate. The Operations Associate oversees maintaining the RAM system and submitting new vetting requests. Once the vetting has been approved or declined, the Operations Associate enters the information into U4I’s relational database, and only at this point can the hiring process move forward, provided RAM approves the vetting. The new system has automated alarm notifications and emails monthly reports based on the “date of last vetting,” calculating the “date of new vetting” automatically for a list of over 85 employees and contractors. Case 1 - In the case of the first vetting issue, there was a staff transition in the Managing Director’s position and the vetting process was not carried out as described above. There was a gap in filling the responsibility attached to this role. Remedy - We have introduced a backup Vetting POC in our vetting process moving forward to prevent this type of occurrence during transitions. If the Managing Director is unavailable, and a confirmation of the vetting task is not received, the Co-Director acting as interim Vetting POC will be asked to assume the role and evaluate the hires and vetting. Case 2 - In the case of the second vetting issue, we could not find any records of evidence in RAM that vetting ever happened, which is an oversight of internal controls. It is possible that the close relationship of many years between the U4I leadership and this company led to overconfidence and a loosening of normal internal controls. It is also possible that since the contractor is a SAM-registered Canadian company also operating in the USA and receiving federal wards, the management considered the vetting procedure unnecessary. We could not consult the individual that was in that vetting POC role at the time as she is no longer working with U4I. Remedy - The FIN/OPS team overseeing the new vetting procedure and added control steps, will make sure that all vendors, contractors and employees, without exclusions and regardless of any subjective levels of mutual trust and regardless the length of existing relationships, are run through the Job Proposal and Vetting Procedure and that the contractual process will be stopped unless there is a RAM record to consider the hire.
CURRENT YEAR FINDINGS 2023-001 Significant deficiency – Procurement of Subcontractors, Significant Deficiency in Internal Controls over Compliance, and Instances of Noncompliance. Criteria: The organization is required by the terms and conditions of the grant agreement with the Department of State, that prior to signing a sub award, including a consultant or contractor agreement, the recipient must submit vetting information to the Office of Risk Analysis Management (RAM) and receive written notification of that sub-recipient’s, consultant, or contractors’ eligibility. Condition and Context: Per review of the Organization’s subcontractor and consulting agreements, we were not provided sufficient evidence that the organization completed the vetting process for 2 of the 7 tested. Effect: Federal funds could be expended to contractors that may not use the funds appropriately. In addition, the Organization could unknowingly fund an enemy of the Untied States. Cause: Contracts were signed, and funds were expended to subcontractors without the proper vetting being completed. Recommendation: We recommend not entering into any agreements or releasing funds paid for by federal grants before the completion of the vetting process, as described by the grant agreement. Managements response: Beginning in early 2023, the Organization implemented a new vetting monitoring system and procedure. All contractors and employees submitted for hire by the Program Managers, or the Executive Director, are referred via a Job Proposal automated task document approval to the Managing Director. The Managing Director is the agreed-upon point of contact with the federal agency to determine if the proposed new hire needs to be vetted based on the criteria set by the federal agency. If the Managing Director deems necessary that the hire needs to be vetted, a vetting task and confirmation of receipt are sent by the system to the Operations Associate. The Operations Associate oversees maintaining the RAM system and submitting new vetting requests. Once the vetting has been approved or declined, the Operations Associate enters the information into U4I’s relational database, and only at this point can the hiring process move forward, provided RAM approves the vetting. The new system has automated alarm notifications and emails monthly reports based on the “date of last vetting,” calculating the “date of new vetting” automatically for a list of over 85 employees and contractors. Case 1 - In the case of the first vetting issue, there was a staff transition in the Managing Director’s position and the vetting process was not carried out as described above. There was a gap in filling the responsibility attached to this role. Remedy - We have introduced a backup Vetting POC in our vetting process moving forward to prevent this type of occurrence during transitions. If the Managing Director is unavailable, and a confirmation of the vetting task is not received, the Co-Director acting as interim Vetting POC will be asked to assume the role and evaluate the hires and vetting. Case 2 - In the case of the second vetting issue, we could not find any records of evidence in RAM that vetting ever happened, which is an oversight of internal controls. It is possible that the close relationship of many years between the U4I leadership and this company led to overconfidence and a loosening of normal internal controls. It is also possible that since the contractor is a SAM-registered Canadian company also operating in the USA and receiving federal wards, the management considered the vetting procedure unnecessary. We could not consult the individual that was in that vetting POC role at the time as she is no longer working with U4I. Remedy - The FIN/OPS team overseeing the new vetting procedure and added control steps, will make sure that all vendors, contractors and employees, without exclusions and regardless of any subjective levels of mutual trust and regardless the length of existing relationships, are run through the Job Proposal and Vetting Procedure and that the contractual process will be stopped unless there is a RAM record to consider the hire.
CURRENT YEAR FINDINGS 2023-001 Significant deficiency – Procurement of Subcontractors, Significant Deficiency in Internal Controls over Compliance, and Instances of Noncompliance. Criteria: The organization is required by the terms and conditions of the grant agreement with the Department of State, that prior to signing a sub award, including a consultant or contractor agreement, the recipient must submit vetting information to the Office of Risk Analysis Management (RAM) and receive written notification of that sub-recipient’s, consultant, or contractors’ eligibility. Condition and Context: Per review of the Organization’s subcontractor and consulting agreements, we were not provided sufficient evidence that the organization completed the vetting process for 2 of the 7 tested. Effect: Federal funds could be expended to contractors that may not use the funds appropriately. In addition, the Organization could unknowingly fund an enemy of the Untied States. Cause: Contracts were signed, and funds were expended to subcontractors without the proper vetting being completed. Recommendation: We recommend not entering into any agreements or releasing funds paid for by federal grants before the completion of the vetting process, as described by the grant agreement. Managements response: Beginning in early 2023, the Organization implemented a new vetting monitoring system and procedure. All contractors and employees submitted for hire by the Program Managers, or the Executive Director, are referred via a Job Proposal automated task document approval to the Managing Director. The Managing Director is the agreed-upon point of contact with the federal agency to determine if the proposed new hire needs to be vetted based on the criteria set by the federal agency. If the Managing Director deems necessary that the hire needs to be vetted, a vetting task and confirmation of receipt are sent by the system to the Operations Associate. The Operations Associate oversees maintaining the RAM system and submitting new vetting requests. Once the vetting has been approved or declined, the Operations Associate enters the information into U4I’s relational database, and only at this point can the hiring process move forward, provided RAM approves the vetting. The new system has automated alarm notifications and emails monthly reports based on the “date of last vetting,” calculating the “date of new vetting” automatically for a list of over 85 employees and contractors. Case 1 - In the case of the first vetting issue, there was a staff transition in the Managing Director’s position and the vetting process was not carried out as described above. There was a gap in filling the responsibility attached to this role. Remedy - We have introduced a backup Vetting POC in our vetting process moving forward to prevent this type of occurrence during transitions. If the Managing Director is unavailable, and a confirmation of the vetting task is not received, the Co-Director acting as interim Vetting POC will be asked to assume the role and evaluate the hires and vetting. Case 2 - In the case of the second vetting issue, we could not find any records of evidence in RAM that vetting ever happened, which is an oversight of internal controls. It is possible that the close relationship of many years between the U4I leadership and this company led to overconfidence and a loosening of normal internal controls. It is also possible that since the contractor is a SAM-registered Canadian company also operating in the USA and receiving federal wards, the management considered the vetting procedure unnecessary. We could not consult the individual that was in that vetting POC role at the time as she is no longer working with U4I. Remedy - The FIN/OPS team overseeing the new vetting procedure and added control steps, will make sure that all vendors, contractors and employees, without exclusions and regardless of any subjective levels of mutual trust and regardless the length of existing relationships, are run through the Job Proposal and Vetting Procedure and that the contractual process will be stopped unless there is a RAM record to consider the hire.
CURRENT YEAR FINDINGS 2023-001 Significant deficiency – Procurement of Subcontractors, Significant Deficiency in Internal Controls over Compliance, and Instances of Noncompliance. Criteria: The organization is required by the terms and conditions of the grant agreement with the Department of State, that prior to signing a sub award, including a consultant or contractor agreement, the recipient must submit vetting information to the Office of Risk Analysis Management (RAM) and receive written notification of that sub-recipient’s, consultant, or contractors’ eligibility. Condition and Context: Per review of the Organization’s subcontractor and consulting agreements, we were not provided sufficient evidence that the organization completed the vetting process for 2 of the 7 tested. Effect: Federal funds could be expended to contractors that may not use the funds appropriately. In addition, the Organization could unknowingly fund an enemy of the Untied States. Cause: Contracts were signed, and funds were expended to subcontractors without the proper vetting being completed. Recommendation: We recommend not entering into any agreements or releasing funds paid for by federal grants before the completion of the vetting process, as described by the grant agreement. Managements response: Beginning in early 2023, the Organization implemented a new vetting monitoring system and procedure. All contractors and employees submitted for hire by the Program Managers, or the Executive Director, are referred via a Job Proposal automated task document approval to the Managing Director. The Managing Director is the agreed-upon point of contact with the federal agency to determine if the proposed new hire needs to be vetted based on the criteria set by the federal agency. If the Managing Director deems necessary that the hire needs to be vetted, a vetting task and confirmation of receipt are sent by the system to the Operations Associate. The Operations Associate oversees maintaining the RAM system and submitting new vetting requests. Once the vetting has been approved or declined, the Operations Associate enters the information into U4I’s relational database, and only at this point can the hiring process move forward, provided RAM approves the vetting. The new system has automated alarm notifications and emails monthly reports based on the “date of last vetting,” calculating the “date of new vetting” automatically for a list of over 85 employees and contractors. Case 1 - In the case of the first vetting issue, there was a staff transition in the Managing Director’s position and the vetting process was not carried out as described above. There was a gap in filling the responsibility attached to this role. Remedy - We have introduced a backup Vetting POC in our vetting process moving forward to prevent this type of occurrence during transitions. If the Managing Director is unavailable, and a confirmation of the vetting task is not received, the Co-Director acting as interim Vetting POC will be asked to assume the role and evaluate the hires and vetting. Case 2 - In the case of the second vetting issue, we could not find any records of evidence in RAM that vetting ever happened, which is an oversight of internal controls. It is possible that the close relationship of many years between the U4I leadership and this company led to overconfidence and a loosening of normal internal controls. It is also possible that since the contractor is a SAM-registered Canadian company also operating in the USA and receiving federal wards, the management considered the vetting procedure unnecessary. We could not consult the individual that was in that vetting POC role at the time as she is no longer working with U4I. Remedy - The FIN/OPS team overseeing the new vetting procedure and added control steps, will make sure that all vendors, contractors and employees, without exclusions and regardless of any subjective levels of mutual trust and regardless the length of existing relationships, are run through the Job Proposal and Vetting Procedure and that the contractual process will be stopped unless there is a RAM record to consider the hire.
CURRENT YEAR FINDINGS 2023-001 Significant deficiency – Procurement of Subcontractors, Significant Deficiency in Internal Controls over Compliance, and Instances of Noncompliance. Criteria: The organization is required by the terms and conditions of the grant agreement with the Department of State, that prior to signing a sub award, including a consultant or contractor agreement, the recipient must submit vetting information to the Office of Risk Analysis Management (RAM) and receive written notification of that sub-recipient’s, consultant, or contractors’ eligibility. Condition and Context: Per review of the Organization’s subcontractor and consulting agreements, we were not provided sufficient evidence that the organization completed the vetting process for 2 of the 7 tested. Effect: Federal funds could be expended to contractors that may not use the funds appropriately. In addition, the Organization could unknowingly fund an enemy of the Untied States. Cause: Contracts were signed, and funds were expended to subcontractors without the proper vetting being completed. Recommendation: We recommend not entering into any agreements or releasing funds paid for by federal grants before the completion of the vetting process, as described by the grant agreement. Managements response: Beginning in early 2023, the Organization implemented a new vetting monitoring system and procedure. All contractors and employees submitted for hire by the Program Managers, or the Executive Director, are referred via a Job Proposal automated task document approval to the Managing Director. The Managing Director is the agreed-upon point of contact with the federal agency to determine if the proposed new hire needs to be vetted based on the criteria set by the federal agency. If the Managing Director deems necessary that the hire needs to be vetted, a vetting task and confirmation of receipt are sent by the system to the Operations Associate. The Operations Associate oversees maintaining the RAM system and submitting new vetting requests. Once the vetting has been approved or declined, the Operations Associate enters the information into U4I’s relational database, and only at this point can the hiring process move forward, provided RAM approves the vetting. The new system has automated alarm notifications and emails monthly reports based on the “date of last vetting,” calculating the “date of new vetting” automatically for a list of over 85 employees and contractors. Case 1 - In the case of the first vetting issue, there was a staff transition in the Managing Director’s position and the vetting process was not carried out as described above. There was a gap in filling the responsibility attached to this role. Remedy - We have introduced a backup Vetting POC in our vetting process moving forward to prevent this type of occurrence during transitions. If the Managing Director is unavailable, and a confirmation of the vetting task is not received, the Co-Director acting as interim Vetting POC will be asked to assume the role and evaluate the hires and vetting. Case 2 - In the case of the second vetting issue, we could not find any records of evidence in RAM that vetting ever happened, which is an oversight of internal controls. It is possible that the close relationship of many years between the U4I leadership and this company led to overconfidence and a loosening of normal internal controls. It is also possible that since the contractor is a SAM-registered Canadian company also operating in the USA and receiving federal wards, the management considered the vetting procedure unnecessary. We could not consult the individual that was in that vetting POC role at the time as she is no longer working with U4I. Remedy - The FIN/OPS team overseeing the new vetting procedure and added control steps, will make sure that all vendors, contractors and employees, without exclusions and regardless of any subjective levels of mutual trust and regardless the length of existing relationships, are run through the Job Proposal and Vetting Procedure and that the contractual process will be stopped unless there is a RAM record to consider the hire.
CURRENT YEAR FINDINGS 2023-001 Significant deficiency – Procurement of Subcontractors, Significant Deficiency in Internal Controls over Compliance, and Instances of Noncompliance. Criteria: The organization is required by the terms and conditions of the grant agreement with the Department of State, that prior to signing a sub award, including a consultant or contractor agreement, the recipient must submit vetting information to the Office of Risk Analysis Management (RAM) and receive written notification of that sub-recipient’s, consultant, or contractors’ eligibility. Condition and Context: Per review of the Organization’s subcontractor and consulting agreements, we were not provided sufficient evidence that the organization completed the vetting process for 2 of the 7 tested. Effect: Federal funds could be expended to contractors that may not use the funds appropriately. In addition, the Organization could unknowingly fund an enemy of the Untied States. Cause: Contracts were signed, and funds were expended to subcontractors without the proper vetting being completed. Recommendation: We recommend not entering into any agreements or releasing funds paid for by federal grants before the completion of the vetting process, as described by the grant agreement. Managements response: Beginning in early 2023, the Organization implemented a new vetting monitoring system and procedure. All contractors and employees submitted for hire by the Program Managers, or the Executive Director, are referred via a Job Proposal automated task document approval to the Managing Director. The Managing Director is the agreed-upon point of contact with the federal agency to determine if the proposed new hire needs to be vetted based on the criteria set by the federal agency. If the Managing Director deems necessary that the hire needs to be vetted, a vetting task and confirmation of receipt are sent by the system to the Operations Associate. The Operations Associate oversees maintaining the RAM system and submitting new vetting requests. Once the vetting has been approved or declined, the Operations Associate enters the information into U4I’s relational database, and only at this point can the hiring process move forward, provided RAM approves the vetting. The new system has automated alarm notifications and emails monthly reports based on the “date of last vetting,” calculating the “date of new vetting” automatically for a list of over 85 employees and contractors. Case 1 - In the case of the first vetting issue, there was a staff transition in the Managing Director’s position and the vetting process was not carried out as described above. There was a gap in filling the responsibility attached to this role. Remedy - We have introduced a backup Vetting POC in our vetting process moving forward to prevent this type of occurrence during transitions. If the Managing Director is unavailable, and a confirmation of the vetting task is not received, the Co-Director acting as interim Vetting POC will be asked to assume the role and evaluate the hires and vetting. Case 2 - In the case of the second vetting issue, we could not find any records of evidence in RAM that vetting ever happened, which is an oversight of internal controls. It is possible that the close relationship of many years between the U4I leadership and this company led to overconfidence and a loosening of normal internal controls. It is also possible that since the contractor is a SAM-registered Canadian company also operating in the USA and receiving federal wards, the management considered the vetting procedure unnecessary. We could not consult the individual that was in that vetting POC role at the time as she is no longer working with U4I. Remedy - The FIN/OPS team overseeing the new vetting procedure and added control steps, will make sure that all vendors, contractors and employees, without exclusions and regardless of any subjective levels of mutual trust and regardless the length of existing relationships, are run through the Job Proposal and Vetting Procedure and that the contractual process will be stopped unless there is a RAM record to consider the hire.
CURRENT YEAR FINDINGS 2023-001 Significant deficiency – Procurement of Subcontractors, Significant Deficiency in Internal Controls over Compliance, and Instances of Noncompliance. Criteria: The organization is required by the terms and conditions of the grant agreement with the Department of State, that prior to signing a sub award, including a consultant or contractor agreement, the recipient must submit vetting information to the Office of Risk Analysis Management (RAM) and receive written notification of that sub-recipient’s, consultant, or contractors’ eligibility. Condition and Context: Per review of the Organization’s subcontractor and consulting agreements, we were not provided sufficient evidence that the organization completed the vetting process for 2 of the 7 tested. Effect: Federal funds could be expended to contractors that may not use the funds appropriately. In addition, the Organization could unknowingly fund an enemy of the Untied States. Cause: Contracts were signed, and funds were expended to subcontractors without the proper vetting being completed. Recommendation: We recommend not entering into any agreements or releasing funds paid for by federal grants before the completion of the vetting process, as described by the grant agreement. Managements response: Beginning in early 2023, the Organization implemented a new vetting monitoring system and procedure. All contractors and employees submitted for hire by the Program Managers, or the Executive Director, are referred via a Job Proposal automated task document approval to the Managing Director. The Managing Director is the agreed-upon point of contact with the federal agency to determine if the proposed new hire needs to be vetted based on the criteria set by the federal agency. If the Managing Director deems necessary that the hire needs to be vetted, a vetting task and confirmation of receipt are sent by the system to the Operations Associate. The Operations Associate oversees maintaining the RAM system and submitting new vetting requests. Once the vetting has been approved or declined, the Operations Associate enters the information into U4I’s relational database, and only at this point can the hiring process move forward, provided RAM approves the vetting. The new system has automated alarm notifications and emails monthly reports based on the “date of last vetting,” calculating the “date of new vetting” automatically for a list of over 85 employees and contractors. Case 1 - In the case of the first vetting issue, there was a staff transition in the Managing Director’s position and the vetting process was not carried out as described above. There was a gap in filling the responsibility attached to this role. Remedy - We have introduced a backup Vetting POC in our vetting process moving forward to prevent this type of occurrence during transitions. If the Managing Director is unavailable, and a confirmation of the vetting task is not received, the Co-Director acting as interim Vetting POC will be asked to assume the role and evaluate the hires and vetting. Case 2 - In the case of the second vetting issue, we could not find any records of evidence in RAM that vetting ever happened, which is an oversight of internal controls. It is possible that the close relationship of many years between the U4I leadership and this company led to overconfidence and a loosening of normal internal controls. It is also possible that since the contractor is a SAM-registered Canadian company also operating in the USA and receiving federal wards, the management considered the vetting procedure unnecessary. We could not consult the individual that was in that vetting POC role at the time as she is no longer working with U4I. Remedy - The FIN/OPS team overseeing the new vetting procedure and added control steps, will make sure that all vendors, contractors and employees, without exclusions and regardless of any subjective levels of mutual trust and regardless the length of existing relationships, are run through the Job Proposal and Vetting Procedure and that the contractual process will be stopped unless there is a RAM record to consider the hire.
CURRENT YEAR FINDINGS 2023-001 Significant deficiency – Procurement of Subcontractors, Significant Deficiency in Internal Controls over Compliance, and Instances of Noncompliance. Criteria: The organization is required by the terms and conditions of the grant agreement with the Department of State, that prior to signing a sub award, including a consultant or contractor agreement, the recipient must submit vetting information to the Office of Risk Analysis Management (RAM) and receive written notification of that sub-recipient’s, consultant, or contractors’ eligibility. Condition and Context: Per review of the Organization’s subcontractor and consulting agreements, we were not provided sufficient evidence that the organization completed the vetting process for 2 of the 7 tested. Effect: Federal funds could be expended to contractors that may not use the funds appropriately. In addition, the Organization could unknowingly fund an enemy of the Untied States. Cause: Contracts were signed, and funds were expended to subcontractors without the proper vetting being completed. Recommendation: We recommend not entering into any agreements or releasing funds paid for by federal grants before the completion of the vetting process, as described by the grant agreement. Managements response: Beginning in early 2023, the Organization implemented a new vetting monitoring system and procedure. All contractors and employees submitted for hire by the Program Managers, or the Executive Director, are referred via a Job Proposal automated task document approval to the Managing Director. The Managing Director is the agreed-upon point of contact with the federal agency to determine if the proposed new hire needs to be vetted based on the criteria set by the federal agency. If the Managing Director deems necessary that the hire needs to be vetted, a vetting task and confirmation of receipt are sent by the system to the Operations Associate. The Operations Associate oversees maintaining the RAM system and submitting new vetting requests. Once the vetting has been approved or declined, the Operations Associate enters the information into U4I’s relational database, and only at this point can the hiring process move forward, provided RAM approves the vetting. The new system has automated alarm notifications and emails monthly reports based on the “date of last vetting,” calculating the “date of new vetting” automatically for a list of over 85 employees and contractors. Case 1 - In the case of the first vetting issue, there was a staff transition in the Managing Director’s position and the vetting process was not carried out as described above. There was a gap in filling the responsibility attached to this role. Remedy - We have introduced a backup Vetting POC in our vetting process moving forward to prevent this type of occurrence during transitions. If the Managing Director is unavailable, and a confirmation of the vetting task is not received, the Co-Director acting as interim Vetting POC will be asked to assume the role and evaluate the hires and vetting. Case 2 - In the case of the second vetting issue, we could not find any records of evidence in RAM that vetting ever happened, which is an oversight of internal controls. It is possible that the close relationship of many years between the U4I leadership and this company led to overconfidence and a loosening of normal internal controls. It is also possible that since the contractor is a SAM-registered Canadian company also operating in the USA and receiving federal wards, the management considered the vetting procedure unnecessary. We could not consult the individual that was in that vetting POC role at the time as she is no longer working with U4I. Remedy - The FIN/OPS team overseeing the new vetting procedure and added control steps, will make sure that all vendors, contractors and employees, without exclusions and regardless of any subjective levels of mutual trust and regardless the length of existing relationships, are run through the Job Proposal and Vetting Procedure and that the contractual process will be stopped unless there is a RAM record to consider the hire.