2019-001 The Organization had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring.
Assistance Listing Number and Title: 93.959 Block Grants to Prevention
and Treatment of Substance Abuse
Federal Grantor Name: U.S. Department of Health and Human Services
Federal Award/Contract Number: N/A
Pass-through Entity Name: Washington State Department of Social and Health Services
Pass-through Award/Contract Number: 1669-58046
Known Questioned Cost Amount: $0
Prior Year Audit Finding: Yes, Finding 2018-002
Description of Condition
The Substance Abuse Prevention and Treatment Block Grant (SABG) program awards funds to states, territories and one Indian tribe for planning, implementing and evaluating activities that prevent and treat substance abuse. During fiscal year 2019, the Organization spent $872,489 in SABG funds. The Organization passed through all of these funds to five subrecipients.
Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.
When the Organization passes on federal funds to subrecipients, federal regulations require the Organization to ensure every subaward agreement clearly identifies that it is a federal award and includes the applicable federal requirements. Federal regulations require the Organization to include 14 federal award identification
elements in each subaward agreement. Further, the Organization is required to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required.
The Organization did not have internal controls in place for ensuring compliance with subrecipient monitoring requirements. Specifically, the Organization did not have adequate controls for ensuring subaward agreements included the required contract elements, and for ensuring it completed and documented the required risk assessments. Further, the Organization did not monitor subrecipients’ activities to provide reasonable assurance that they administered the subawards in compliance with the subaward’s terms and conditions. Additionally, the Organization did not ensure subrecipients received federal single audits when required and did not review subrecipients’ audits when applicable.
We consider this deficiency in internal controls to be a material weakness that led to material noncompliance.
Cause of Condition
The Organization experienced turnover in its staff responsible for managing the program. As a result, current staff were unaware if the Organization met these compliance requirements and were unable to find supporting documentation to demonstrate compliance with these requirements.
Effect of Condition
We tested all subawards and found the Organization’s subaward agreements did not include all the required contract elements, such as the federal award identification number, Assistance Listing Number, federal program name and unique entity identifier. Without this information, subrecipients are less likely to know that the award is federally funded. This also increases the risk that subrecipients would not know they need to comply with specific program requirements, which could potentially lead them to spend funds for unallowable purposes.
The Organization did not have evidence that it performed document its risk assessments for the subrecipients tested. Not performing risk assessments increases the risk that the Organization will not perform the proper level of monitoring for its subrecipients.
The Organization also did not monitor subrecipients’ activities to provide reasonable assurance they administered the subawards in compliance with the subaward’s terms and conditions. Without adequate monitoring, there is a risk that subrecipients may spend funds for unallowable purposes.
Additionally, the Organization did not verify subrecipients received federal single audits when required, ensure subrecipients took corrective actions for any identified deficiencies, and issue management decisions within six months of audit reports’ issuance for applicable audit findings.
Since the Organization did not monitor its subrecipients, there is no way for it to confirm the subrecipients provided services to eligible participants.
Recommendation
We recommend the Organization strengthen internal controls to:
• Include all required elements in subaward agreements
• Perform and document the required risk assessment sufficiently for management to evaluate the results and monitor subrecipients accordingly
• Perform adequate monitoring of subrecipients to ensure they comply with the subaward’s terms and conditions and only provide funds to eligible participants
• Verify subrecipients receive federal single audits when required and develop follow-up procedures if audits detect and report deficiencies
Organization’s Response
We know that our contracts always included all of the appropriate HCA mandated language regarding sub recipient monitoring required. To the best of our knowledge, our Contract Compliance Officer reviewed compliance of all contracts. Due to the closing of the business and subsequent releasing of all employees, records of the particular compliance activities could not be located, however the Accounting Manager does remember proper audits and reviews being done annually with contracted sub recipients. We have no corrective action plans because all Behavioral Health Organizations were abolished by state statute, Chapter 325, Washington Laws of 2019, which removed Behavioral Health Organizations from the law effective January 1, 2020. Great Rivers Behavioral Health Organization closed business effective December 31, 2019.
Auditor’s Remarks
We thank the Organization for its cooperation and assistance during the audit.
Applicable Laws and Regulations
Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings.
Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.
The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
Title 45 CFR Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 352, Requirements for pass-through entities, establishes subrecipient monitoring regulations.
2019-001 The Organization had inadequate internal controls for ensuring compliance with federal requirements for subrecipient monitoring.
Assistance Listing Number and Title: 93.959 Block Grants to Prevention
and Treatment of Substance Abuse
Federal Grantor Name: U.S. Department of Health and Human Services
Federal Award/Contract Number: N/A
Pass-through Entity Name: Washington State Department of Social and Health Services
Pass-through Award/Contract Number: 1669-58046
Known Questioned Cost Amount: $0
Prior Year Audit Finding: Yes, Finding 2018-002
Description of Condition
The Substance Abuse Prevention and Treatment Block Grant (SABG) program awards funds to states, territories and one Indian tribe for planning, implementing and evaluating activities that prevent and treat substance abuse. During fiscal year 2019, the Organization spent $872,489 in SABG funds. The Organization passed through all of these funds to five subrecipients.
Federal regulations require recipients to establish and maintain internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.
When the Organization passes on federal funds to subrecipients, federal regulations require the Organization to ensure every subaward agreement clearly identifies that it is a federal award and includes the applicable federal requirements. Federal regulations require the Organization to include 14 federal award identification
elements in each subaward agreement. Further, the Organization is required to evaluate every subrecipient’s risk of noncompliance with federal requirements to determine the appropriate level of subrecipient monitoring. Subrecipient monitoring requirements include ensuring compliance with program requirements, ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required.
The Organization did not have internal controls in place for ensuring compliance with subrecipient monitoring requirements. Specifically, the Organization did not have adequate controls for ensuring subaward agreements included the required contract elements, and for ensuring it completed and documented the required risk assessments. Further, the Organization did not monitor subrecipients’ activities to provide reasonable assurance that they administered the subawards in compliance with the subaward’s terms and conditions. Additionally, the Organization did not ensure subrecipients received federal single audits when required and did not review subrecipients’ audits when applicable.
We consider this deficiency in internal controls to be a material weakness that led to material noncompliance.
Cause of Condition
The Organization experienced turnover in its staff responsible for managing the program. As a result, current staff were unaware if the Organization met these compliance requirements and were unable to find supporting documentation to demonstrate compliance with these requirements.
Effect of Condition
We tested all subawards and found the Organization’s subaward agreements did not include all the required contract elements, such as the federal award identification number, Assistance Listing Number, federal program name and unique entity identifier. Without this information, subrecipients are less likely to know that the award is federally funded. This also increases the risk that subrecipients would not know they need to comply with specific program requirements, which could potentially lead them to spend funds for unallowable purposes.
The Organization did not have evidence that it performed document its risk assessments for the subrecipients tested. Not performing risk assessments increases the risk that the Organization will not perform the proper level of monitoring for its subrecipients.
The Organization also did not monitor subrecipients’ activities to provide reasonable assurance they administered the subawards in compliance with the subaward’s terms and conditions. Without adequate monitoring, there is a risk that subrecipients may spend funds for unallowable purposes.
Additionally, the Organization did not verify subrecipients received federal single audits when required, ensure subrecipients took corrective actions for any identified deficiencies, and issue management decisions within six months of audit reports’ issuance for applicable audit findings.
Since the Organization did not monitor its subrecipients, there is no way for it to confirm the subrecipients provided services to eligible participants.
Recommendation
We recommend the Organization strengthen internal controls to:
• Include all required elements in subaward agreements
• Perform and document the required risk assessment sufficiently for management to evaluate the results and monitor subrecipients accordingly
• Perform adequate monitoring of subrecipients to ensure they comply with the subaward’s terms and conditions and only provide funds to eligible participants
• Verify subrecipients receive federal single audits when required and develop follow-up procedures if audits detect and report deficiencies
Organization’s Response
We know that our contracts always included all of the appropriate HCA mandated language regarding sub recipient monitoring required. To the best of our knowledge, our Contract Compliance Officer reviewed compliance of all contracts. Due to the closing of the business and subsequent releasing of all employees, records of the particular compliance activities could not be located, however the Accounting Manager does remember proper audits and reviews being done annually with contracted sub recipients. We have no corrective action plans because all Behavioral Health Organizations were abolished by state statute, Chapter 325, Washington Laws of 2019, which removed Behavioral Health Organizations from the law effective January 1, 2020. Great Rivers Behavioral Health Organization closed business effective December 31, 2019.
Auditor’s Remarks
We thank the Organization for its cooperation and assistance during the audit.
Applicable Laws and Regulations
Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings.
Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.
The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
Title 45 CFR Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 352, Requirements for pass-through entities, establishes subrecipient monitoring regulations.