Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-002 Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services (HHS) Health Resources and Services Administration (HRSA) Assistance Listing: 93.498; COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution (PRF) Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Condition: In our allowability testing, for PRF expenses submitted for reporting period 4, management did not maintain documentation to support the review and approval of one timecard evidencing contract labor hours and activities performed at a Sanford senior care facility. We further noted two expenses, for reporting period 4, where management did not maintain documentation to support the review and approval of the invoice for contract labor at a Sanford senior care facility. Management represented that the timecard and invoices for the Sanford senior care facility were reviewed and approved prior to payment and submission of contract labor expenses for PRF. Cause: Management did not have sufficient internal controls in place to retain documentation of its review and approval of the timecard and invoices for the Sanford senior care facility. Effect or potential effect: Lack of adequate internal controls could potentially result in unallowable costs charged to the PRF program. Questioned costs: $0 Context: We tested a total of 40 expenditures and noted that the documentation to support the review and approval for one contractor timecard and two contract labor invoices was not maintained for a Sanford senior care facility. Contract labor expenses, which were submitted for PRF reporting period 4, totaled $4,287,482. For the senior care facility that did not have documentation to support the review and approval of contractor timecard and contract labor invoices, $152,539 in total contract labor expenses were submitted for PRF reporting period 4. The total amounts reported on the SEFA, which includes reporting period 3 and reporting period 4, is $74,311,100. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should enhance its internal controls and ensure that it retains documentation and evidence of its review and approval of contract labor timecards and contract labor invoices at the Sanford senior care facility. Views of responsible officials: Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being used for unallowable contract labor costs. Sanford believes that the risk of any material contract labor costs being incorrectly charged to a federal grant is effectively mitigated through existing preventive and detective internal controls. Sanford will re-educate the senior care facility?s administrators and enhance its procedural documentation regarding retention of evidence related to the approval of contract labor timecards and payment of contract labor invoices for this facility to be consistent with the over 200 other facilities across the system.
Finding 2022-002 Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services (HHS) Health Resources and Services Administration (HRSA) Assistance Listing: 93.498; COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution (PRF) Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Condition: In our allowability testing, for PRF expenses submitted for reporting period 4, management did not maintain documentation to support the review and approval of one timecard evidencing contract labor hours and activities performed at a Sanford senior care facility. We further noted two expenses, for reporting period 4, where management did not maintain documentation to support the review and approval of the invoice for contract labor at a Sanford senior care facility. Management represented that the timecard and invoices for the Sanford senior care facility were reviewed and approved prior to payment and submission of contract labor expenses for PRF. Cause: Management did not have sufficient internal controls in place to retain documentation of its review and approval of the timecard and invoices for the Sanford senior care facility. Effect or potential effect: Lack of adequate internal controls could potentially result in unallowable costs charged to the PRF program. Questioned costs: $0 Context: We tested a total of 40 expenditures and noted that the documentation to support the review and approval for one contractor timecard and two contract labor invoices was not maintained for a Sanford senior care facility. Contract labor expenses, which were submitted for PRF reporting period 4, totaled $4,287,482. For the senior care facility that did not have documentation to support the review and approval of contractor timecard and contract labor invoices, $152,539 in total contract labor expenses were submitted for PRF reporting period 4. The total amounts reported on the SEFA, which includes reporting period 3 and reporting period 4, is $74,311,100. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should enhance its internal controls and ensure that it retains documentation and evidence of its review and approval of contract labor timecards and contract labor invoices at the Sanford senior care facility. Views of responsible officials: Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being used for unallowable contract labor costs. Sanford believes that the risk of any material contract labor costs being incorrectly charged to a federal grant is effectively mitigated through existing preventive and detective internal controls. Sanford will re-educate the senior care facility?s administrators and enhance its procedural documentation regarding retention of evidence related to the approval of contract labor timecards and payment of contract labor invoices for this facility to be consistent with the over 200 other facilities across the system.
Finding 2022-002 Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services (HHS) Health Resources and Services Administration (HRSA) Assistance Listing: 93.498; COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution (PRF) Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Condition: In our allowability testing, for PRF expenses submitted for reporting period 4, management did not maintain documentation to support the review and approval of one timecard evidencing contract labor hours and activities performed at a Sanford senior care facility. We further noted two expenses, for reporting period 4, where management did not maintain documentation to support the review and approval of the invoice for contract labor at a Sanford senior care facility. Management represented that the timecard and invoices for the Sanford senior care facility were reviewed and approved prior to payment and submission of contract labor expenses for PRF. Cause: Management did not have sufficient internal controls in place to retain documentation of its review and approval of the timecard and invoices for the Sanford senior care facility. Effect or potential effect: Lack of adequate internal controls could potentially result in unallowable costs charged to the PRF program. Questioned costs: $0 Context: We tested a total of 40 expenditures and noted that the documentation to support the review and approval for one contractor timecard and two contract labor invoices was not maintained for a Sanford senior care facility. Contract labor expenses, which were submitted for PRF reporting period 4, totaled $4,287,482. For the senior care facility that did not have documentation to support the review and approval of contractor timecard and contract labor invoices, $152,539 in total contract labor expenses were submitted for PRF reporting period 4. The total amounts reported on the SEFA, which includes reporting period 3 and reporting period 4, is $74,311,100. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should enhance its internal controls and ensure that it retains documentation and evidence of its review and approval of contract labor timecards and contract labor invoices at the Sanford senior care facility. Views of responsible officials: Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being used for unallowable contract labor costs. Sanford believes that the risk of any material contract labor costs being incorrectly charged to a federal grant is effectively mitigated through existing preventive and detective internal controls. Sanford will re-educate the senior care facility?s administrators and enhance its procedural documentation regarding retention of evidence related to the approval of contract labor timecards and payment of contract labor invoices for this facility to be consistent with the over 200 other facilities across the system.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-002 Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services (HHS) Health Resources and Services Administration (HRSA) Assistance Listing: 93.498; COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution (PRF) Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Condition: In our allowability testing, for PRF expenses submitted for reporting period 4, management did not maintain documentation to support the review and approval of one timecard evidencing contract labor hours and activities performed at a Sanford senior care facility. We further noted two expenses, for reporting period 4, where management did not maintain documentation to support the review and approval of the invoice for contract labor at a Sanford senior care facility. Management represented that the timecard and invoices for the Sanford senior care facility were reviewed and approved prior to payment and submission of contract labor expenses for PRF. Cause: Management did not have sufficient internal controls in place to retain documentation of its review and approval of the timecard and invoices for the Sanford senior care facility. Effect or potential effect: Lack of adequate internal controls could potentially result in unallowable costs charged to the PRF program. Questioned costs: $0 Context: We tested a total of 40 expenditures and noted that the documentation to support the review and approval for one contractor timecard and two contract labor invoices was not maintained for a Sanford senior care facility. Contract labor expenses, which were submitted for PRF reporting period 4, totaled $4,287,482. For the senior care facility that did not have documentation to support the review and approval of contractor timecard and contract labor invoices, $152,539 in total contract labor expenses were submitted for PRF reporting period 4. The total amounts reported on the SEFA, which includes reporting period 3 and reporting period 4, is $74,311,100. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should enhance its internal controls and ensure that it retains documentation and evidence of its review and approval of contract labor timecards and contract labor invoices at the Sanford senior care facility. Views of responsible officials: Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being used for unallowable contract labor costs. Sanford believes that the risk of any material contract labor costs being incorrectly charged to a federal grant is effectively mitigated through existing preventive and detective internal controls. Sanford will re-educate the senior care facility?s administrators and enhance its procedural documentation regarding retention of evidence related to the approval of contract labor timecards and payment of contract labor invoices for this facility to be consistent with the over 200 other facilities across the system.
Finding 2022-002 Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services (HHS) Health Resources and Services Administration (HRSA) Assistance Listing: 93.498; COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution (PRF) Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Condition: In our allowability testing, for PRF expenses submitted for reporting period 4, management did not maintain documentation to support the review and approval of one timecard evidencing contract labor hours and activities performed at a Sanford senior care facility. We further noted two expenses, for reporting period 4, where management did not maintain documentation to support the review and approval of the invoice for contract labor at a Sanford senior care facility. Management represented that the timecard and invoices for the Sanford senior care facility were reviewed and approved prior to payment and submission of contract labor expenses for PRF. Cause: Management did not have sufficient internal controls in place to retain documentation of its review and approval of the timecard and invoices for the Sanford senior care facility. Effect or potential effect: Lack of adequate internal controls could potentially result in unallowable costs charged to the PRF program. Questioned costs: $0 Context: We tested a total of 40 expenditures and noted that the documentation to support the review and approval for one contractor timecard and two contract labor invoices was not maintained for a Sanford senior care facility. Contract labor expenses, which were submitted for PRF reporting period 4, totaled $4,287,482. For the senior care facility that did not have documentation to support the review and approval of contractor timecard and contract labor invoices, $152,539 in total contract labor expenses were submitted for PRF reporting period 4. The total amounts reported on the SEFA, which includes reporting period 3 and reporting period 4, is $74,311,100. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should enhance its internal controls and ensure that it retains documentation and evidence of its review and approval of contract labor timecards and contract labor invoices at the Sanford senior care facility. Views of responsible officials: Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being used for unallowable contract labor costs. Sanford believes that the risk of any material contract labor costs being incorrectly charged to a federal grant is effectively mitigated through existing preventive and detective internal controls. Sanford will re-educate the senior care facility?s administrators and enhance its procedural documentation regarding retention of evidence related to the approval of contract labor timecards and payment of contract labor invoices for this facility to be consistent with the over 200 other facilities across the system.
Finding 2022-002 Identification of the federal program: Federal Agency: U.S. Department of Health and Human Services (HHS) Health Resources and Services Administration (HRSA) Assistance Listing: 93.498; COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution (PRF) Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Condition: In our allowability testing, for PRF expenses submitted for reporting period 4, management did not maintain documentation to support the review and approval of one timecard evidencing contract labor hours and activities performed at a Sanford senior care facility. We further noted two expenses, for reporting period 4, where management did not maintain documentation to support the review and approval of the invoice for contract labor at a Sanford senior care facility. Management represented that the timecard and invoices for the Sanford senior care facility were reviewed and approved prior to payment and submission of contract labor expenses for PRF. Cause: Management did not have sufficient internal controls in place to retain documentation of its review and approval of the timecard and invoices for the Sanford senior care facility. Effect or potential effect: Lack of adequate internal controls could potentially result in unallowable costs charged to the PRF program. Questioned costs: $0 Context: We tested a total of 40 expenditures and noted that the documentation to support the review and approval for one contractor timecard and two contract labor invoices was not maintained for a Sanford senior care facility. Contract labor expenses, which were submitted for PRF reporting period 4, totaled $4,287,482. For the senior care facility that did not have documentation to support the review and approval of contractor timecard and contract labor invoices, $152,539 in total contract labor expenses were submitted for PRF reporting period 4. The total amounts reported on the SEFA, which includes reporting period 3 and reporting period 4, is $74,311,100. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should enhance its internal controls and ensure that it retains documentation and evidence of its review and approval of contract labor timecards and contract labor invoices at the Sanford senior care facility. Views of responsible officials: Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being used for unallowable contract labor costs. Sanford believes that the risk of any material contract labor costs being incorrectly charged to a federal grant is effectively mitigated through existing preventive and detective internal controls. Sanford will re-educate the senior care facility?s administrators and enhance its procedural documentation regarding retention of evidence related to the approval of contract labor timecards and payment of contract labor invoices for this facility to be consistent with the over 200 other facilities across the system.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.