Inadequate Subrecipient Monitoring
21.027 Coronavirus State and Local Fiscal Recovery Funds
(Material Weakness in Internal Control over Compliance and on Compliance)
(Section M – Subrecipient Monitoring)
Condition: The Organization expended $383,497 in federal awards to subrecipients under an
annual contract with the subrecipient. The Organization did not adequately monitor the
subrecipients use of the federal awards or comply with other compliance requirements such
as internal risk assessment. Although a summary of funds spent is received, the Organization
does not receive supporting documentation for the subrecipient’s expenses nor is there
indication that the summary of expenses is reviewed by an appropriate member of
management.
Criteria: Per the Uniform Guidance Compliance Supplement, Section M, Subrecipient
Monitoring, the Organization must monitor the activities of the subrecipient as necessary to
ensure that the subaward is used for authorized purposes, complies with the terms and
conditions of the subaward, and achieves performance goals. Because the Organization is
held accountable for federal awards administered to its subrecipients, the Organization should
establish an appropriate subrecipient monitoring process to evaluate the additional monitoring
activities may be necessary to ensure the subrecipients compliance.
Cause: The Organization obtained their first federal funding as a result of the COVID-19
pandemic. The Organization did not have an internal control system in place to meet the
criteria required under the more robust internal control framework provided by the Uniform
Guidance. As a result, even though expenses were “approved” by the Executive Director, no
documentation existed showing such approval.
Effect: The Organization in compliance with the subrecipient monitoring requirement.
Recommendation: A sound system of internal control over compliance with federal award
programs includes the “who, what, when, and how” of controls. In other words, identify the
person with the necessary skills, knowledge, and experience, that performs the specified
control, whether it be preventative or detective in nature. Further, identify how the control is
performed and how often the control is performed.
In order to comply with the Subrecipient Monitoring compliance requirement, the Organization
should designation a person(s) with the appropriate skills, knowledge and experience to:
a. Review subrecipient’s financial and performance reports on a regular basis to ensure
they are accurate, submitted on time, and comply with requirements. This includes
reviewing the detail supporting documentation to support those financial reports. The
review should be documented by initial signature and date of review by the assigned
personnel.
b. Create written policies and procedures for subrecipient monitoring and risk assessment.
The risk assessment should evaluate the subrecipients risk of noncompliance based on
factors such as audits, personnel, and policies.
Management’s Response: See management’s corrective action plan.
Inadequate Documentation of Expense Approvals
21.027 Coronavirus State and Local Fiscal Recovery Funds
(Significant Deficiency in Internal Control Over Compliance)
(Section A – Activities Allowed and Unallowed, Section B – Allowable Costs, Section H –
Period of Performance)
Condition: We noted several instances in which there was no documentation verifying
management’s review and approval of credit card expenditures charged to the grant indicating
that the transactions had been reviewed to comply with Activities Allowed or Unallowed,
Allowable Costs, and Period of Performance in accordance with the grant terms.
Criteria: Title 2 of the Code of Federal Regulations, Section 200.303(a) states that the non-
Federal entity must, “Establish and maintain effective internal control over the Federal award
that provides reasonable assurance that the non-Federal entity is managing the Federal award
in compliance with Federal statutes, regulations, and the terms and conditions of the Federal
award. These internal controls should be in compliance with guidance in “Standards for
Internal Control in the Federal Government” issued by the Comptroller General of the United
States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring
Organizations of the Treadway Commission (COSO).”
Cause: The Organization has controls in place around credit card purchases, which includes
a request and approval process embedded within the system, Bill Spend and Expense (Divvy),
where only Directors can approve funds. However, an audit trail evidencing the appropriate
personnel’s review was unable to be pulled from the system.
Effect: Ineffective review of expenditures charged to the grant could potentially result in
noncompliance if the expenditure is for an unallowable activity, unallowable cost, or incurred
outside the period of performance.
Context: A sample of fifteen (15) general disbursement expenditures were selected for testing.
Management was unable to provide documentation verifying the appropriate personnel’s
review and approval of fourteen (14) of the selected expenditures.
Recommendation: We recommend that controls be implemented to properly document
management’s review and approval of expenditures. This can be done in a number of ways,
including, but not limited to: email of approval, physical signature or initial and date on invoice
or receipt, payment request form which includes transaction details and approvals.
Management’s Response: See accompanying management’s corrective action plan.
Lack of Formally Adopted Procurement Policy
21.027 Coronavirus State and Local Fiscal Recovery Funds
(Significant Deficiency in Internal Control over Compliance)
(Section I – Procurement and Suspension and Debarment)
Condition: The Organization does not have a documented procurement policy in place.
Criteria: Per the Uniform Guidance Compliance Supplement, Section I, Procurement and
Suspension and Debarment, recipients are expected to have procurement policies and
procedures in place that comply with the procurement standards outlined in Title 2 CFR
Sections 200.317 through 200.327.
Cause: The Organization obtained their first federal funding as a result of the COVID-19
pandemic. The Organization did not have a documented procurement policy in place to meet
the criteria required under Uniform Guidance. As a result, even though expenditures over
$15,000 require additional approvals, no documented policy was in place during 2023.
Effect: Lack of a documented procurement policy could result in inappropriate vendor
preferences or conflicts of interest.
Recommendation: We recommend a formal written procurement policy be implemented that
complies with Uniform Guidance.
Management’s Response: See accompanying management’s corrective action plan.
Inadequate Subrecipient Monitoring
21.027 Coronavirus State and Local Fiscal Recovery Funds
(Material Weakness in Internal Control over Compliance and on Compliance)
(Section M – Subrecipient Monitoring)
Condition: The Organization expended $383,497 in federal awards to subrecipients under an
annual contract with the subrecipient. The Organization did not adequately monitor the
subrecipients use of the federal awards or comply with other compliance requirements such
as internal risk assessment. Although a summary of funds spent is received, the Organization
does not receive supporting documentation for the subrecipient’s expenses nor is there
indication that the summary of expenses is reviewed by an appropriate member of
management.
Criteria: Per the Uniform Guidance Compliance Supplement, Section M, Subrecipient
Monitoring, the Organization must monitor the activities of the subrecipient as necessary to
ensure that the subaward is used for authorized purposes, complies with the terms and
conditions of the subaward, and achieves performance goals. Because the Organization is
held accountable for federal awards administered to its subrecipients, the Organization should
establish an appropriate subrecipient monitoring process to evaluate the additional monitoring
activities may be necessary to ensure the subrecipients compliance.
Cause: The Organization obtained their first federal funding as a result of the COVID-19
pandemic. The Organization did not have an internal control system in place to meet the
criteria required under the more robust internal control framework provided by the Uniform
Guidance. As a result, even though expenses were “approved” by the Executive Director, no
documentation existed showing such approval.
Effect: The Organization in compliance with the subrecipient monitoring requirement.
Recommendation: A sound system of internal control over compliance with federal award
programs includes the “who, what, when, and how” of controls. In other words, identify the
person with the necessary skills, knowledge, and experience, that performs the specified
control, whether it be preventative or detective in nature. Further, identify how the control is
performed and how often the control is performed.
In order to comply with the Subrecipient Monitoring compliance requirement, the Organization
should designation a person(s) with the appropriate skills, knowledge and experience to:
a. Review subrecipient’s financial and performance reports on a regular basis to ensure
they are accurate, submitted on time, and comply with requirements. This includes
reviewing the detail supporting documentation to support those financial reports. The
review should be documented by initial signature and date of review by the assigned
personnel.
b. Create written policies and procedures for subrecipient monitoring and risk assessment.
The risk assessment should evaluate the subrecipients risk of noncompliance based on
factors such as audits, personnel, and policies.
Management’s Response: See management’s corrective action plan.
Inadequate Documentation of Expense Approvals
21.027 Coronavirus State and Local Fiscal Recovery Funds
(Significant Deficiency in Internal Control Over Compliance)
(Section A – Activities Allowed and Unallowed, Section B – Allowable Costs, Section H –
Period of Performance)
Condition: We noted several instances in which there was no documentation verifying
management’s review and approval of credit card expenditures charged to the grant indicating
that the transactions had been reviewed to comply with Activities Allowed or Unallowed,
Allowable Costs, and Period of Performance in accordance with the grant terms.
Criteria: Title 2 of the Code of Federal Regulations, Section 200.303(a) states that the non-
Federal entity must, “Establish and maintain effective internal control over the Federal award
that provides reasonable assurance that the non-Federal entity is managing the Federal award
in compliance with Federal statutes, regulations, and the terms and conditions of the Federal
award. These internal controls should be in compliance with guidance in “Standards for
Internal Control in the Federal Government” issued by the Comptroller General of the United
States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring
Organizations of the Treadway Commission (COSO).”
Cause: The Organization has controls in place around credit card purchases, which includes
a request and approval process embedded within the system, Bill Spend and Expense (Divvy),
where only Directors can approve funds. However, an audit trail evidencing the appropriate
personnel’s review was unable to be pulled from the system.
Effect: Ineffective review of expenditures charged to the grant could potentially result in
noncompliance if the expenditure is for an unallowable activity, unallowable cost, or incurred
outside the period of performance.
Context: A sample of fifteen (15) general disbursement expenditures were selected for testing.
Management was unable to provide documentation verifying the appropriate personnel’s
review and approval of fourteen (14) of the selected expenditures.
Recommendation: We recommend that controls be implemented to properly document
management’s review and approval of expenditures. This can be done in a number of ways,
including, but not limited to: email of approval, physical signature or initial and date on invoice
or receipt, payment request form which includes transaction details and approvals.
Management’s Response: See accompanying management’s corrective action plan.
Lack of Formally Adopted Procurement Policy
21.027 Coronavirus State and Local Fiscal Recovery Funds
(Significant Deficiency in Internal Control over Compliance)
(Section I – Procurement and Suspension and Debarment)
Condition: The Organization does not have a documented procurement policy in place.
Criteria: Per the Uniform Guidance Compliance Supplement, Section I, Procurement and
Suspension and Debarment, recipients are expected to have procurement policies and
procedures in place that comply with the procurement standards outlined in Title 2 CFR
Sections 200.317 through 200.327.
Cause: The Organization obtained their first federal funding as a result of the COVID-19
pandemic. The Organization did not have a documented procurement policy in place to meet
the criteria required under Uniform Guidance. As a result, even though expenditures over
$15,000 require additional approvals, no documented policy was in place during 2023.
Effect: Lack of a documented procurement policy could result in inappropriate vendor
preferences or conflicts of interest.
Recommendation: We recommend a formal written procurement policy be implemented that
complies with Uniform Guidance.
Management’s Response: See accompanying management’s corrective action plan.