Audit 359160

Cash Management Federal Department – U.S. Department of Justice Pass-through Illinois Criminal Justice Information Authority Federal Award Identification Number and Year: 15JOVW-21-GG-00543-STOP and 2021 15JOVW-22-GG-00422-STOP and 2022 Violence Against Women Formula Grants, Federal Assistance Listing #16.588 County Department – State’s Attorney Office Finding 2024 – 001 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements Standards for Financial and Program Management, Section 200.305 Federal Payment (b)(3) Payments for recipients and subrecipients other than States requires that, “Reimbursement is preferred when the requirements in paragraph (b) cannot be met, when the Federal agency or pass-through entity sets a specific condition per Section 200.208, when requested by the recipient or subrecipient, when a Federal award is for construction, or when a significant portion of the construction project is accomplished through private market financing or Federal loans and the Federal award constitutes a minor portion of the project. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper.” CONDITION During the current audit period, the Cook County State’s Attorney Office (SAO) did not adequately comply with its cash management requirements in accordance with federal regulations. CAUSE Based on discussions with management, a portion of the late payments resulted from the SAO’s Program Managers being unable to provide sufficient documentation demonstrating that the delays were due to late invoice submissions by subrecipients. As a result, the Auditor could not verify whether the non-compliance was attributable to subrecipient actions. The remaining delays were due to weaknesses in the payment processing system, which relied heavily on email communications between involved parties. These emails, initiated by the Accounts Payable Processor, were not acted upon in a timely manner, resulting in payments being processed well over the thirty (30) days after initial submission. EFFECT The failure to pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s billing or payment request is a violation of federal regulations. This could impact the subrecipient’s ability to adequately perform its programmatic responsibilities under the program. QUESTIONED COSTS None. CONTEXT During our test of 29 subrecipients’ expenditures, we noted 17 instances where payments to the subrecipients’ were not made within 30 days after receipt of the subrecipient’s payment request. The payments were submitted late, ranging from 2 to 313 days late. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that SAO develop and implement procedures to ensure payments to subrecipients are made within 30 days after receipt of the subrecipients billing or payment request, as required. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 38.

Subrecipient Monitoring Federal Department – U.S. Department of Justice Pass-through Illinois Criminal Justice Information Authority Federal Award Identification Number and Year: 15JOVW-21-GG-00543-STOP and 2021 15JOVW-22-GG-00422-STOP and 2022 Violence Against Women Formula Grants, Federal Assistance Listing #16.588 County Department – State’s Attorney Office Finding 2024 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4)Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. CONDITION During the current audit period, the Cook County State’s Attorney Office (SAO) did not adequately comply with its subrecipient monitoring requirements as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding was an inadequate understanding of sub-recipient monitoring policies and best practices. While the Department believed at the time that they were in compliance with the applicable monitoring requirements, they now recognize that their efforts did not fully meet the necessary standards. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in the inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of two (2) subrecipients (of a population of 4 subrecipients), we noted the following:  For both subrecipients, we noted documentation was not maintained to support SAO’s evaluation of the subrecipients’ risk of noncompliance and the frequency of monitoring to be conducted by SAO based on the assessed risk.  We also noted for both subrecipients, no documentation was provided to verify whether the subrecipients were required to have a Single Audit conducted, including SAO’s review of the report, and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.332e(3).  The SAO utilized a “Subrecipient Monitoring Checklist” (Checklist) to conduct and document its monitoring of subrecipients. Based on review, we noted the Checklist does not include evidence of who completed the monitoring, the date the actual monitoring was performed nor the subrecipient personnel with whom the monitoring results were discussed during the site visit. Also, the Checklist appears to be inaccurately completed. Specifically, we noted the Checklist noted that the results include expected corrective actions and dates for resolution. However, there was no finding or issues noted in the formal letter submitted to the subrecipient(s) after the site visit(s). IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend SAO implement procedures to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance and review of the Single audit report, as required by Federal regulations. Also, we suggest that the Checklist be accurately prepared and updated to include evidence of who completed the monitoring, the date the actual monitoring was performed, and the subrecipient personnel with whom the monitoring results were discussed during the site visit. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 38-39.

Reporting Federal Department – U.S. Department of Treasury Pass-through Illinois Department of Human Services Federal Award Identification Number and Year: SLFRP4406 and 2021 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds, Federal Assistance Listing #21.027 County Department – Justice Advisory Council Finding 2024 – 003 CRITERIA As required by the grant agreement with the State of Illinois, Department of Human Services (IDHS), Exhibit B, Deliverables. 4. Reporting Requirements, states “i. Pursuant to Paragraph 13.1 and 13.2 Cook County will submit monthly, quarterly and final Periodic Financial Reports (PFRs) in the format prescribed by IDHS. The monthly, quarterly and final Periodic Financial Reports must be submitted no later than the 15th of each month for the preceding month or quarter by email. The final year-end report (July 1st - June 30th) will be due on or before July 15th or no more than 30 days following grant termination. ii. Pursuant to Paragraph 13.1 and 13.2 Cook County will submit quarterly and final Periodic Performance Reports (PPRs) in the format prescribed by IDHS. Quarterly and Final Periodic Performance Reports are due no later than the 15th of each month for the preceding quarter by email. Quarter 1 (July 1st - September 30th) due October 15th, Quarter 2 (October 1st- December 31st) due January 15th, Quarter 3 (January 1st- March 31st) due April 15th, and Quarter 4 (April 1st- June 30th) due July 15th). The final year-end report (July 1st -June 30th) will be due on or before July 15th or no more than 30 days following grant termination. Performance reports will include a detailed account of how Cook County is ensuring compliance with 2 CFR 200.332. iii. Annual Program Application Plan: Providers are required to submit an Annual Program Application/Plan each year. Annual Program Plans for Programs exempt from 30 ILCS 708 (GATA) or during a renewal year will be due in April/May of each year for the upcoming program year.” CONDITION During the current audit period, Cook County Justice Advisory Council (JAC) did not comply with the reporting requirements as outlined in its grant agreement. CAUSE Based on discussions with management, the March 2024 monthly financial finding occurred due to reconciling actual expenditures for the 5-month grant period close-out. The quarterly performance report finding occurred due to an adjusted 30 days reporting schedule allowed verbally by the grantor. EFFECT Failure to submit reports in a timely manner could impair the grantor agency’s ability to monitor program activities and could result in the loss of grant funding. QUESTIONED COSTS None. CONTEXT During our review, we noted the IDHS grant agreement ended on June 30, 2024, which represented seven months of required reporting to be submitted during the County’s fiscal year. As a result, we reviewed a total of eight reports submitted (three monthly financial (of a population of 7 monthly reports), one quarterly financial and one quarterly performance report (of a population of 2 quarterly financial and performance reports), one final financial and one final performance report, and one annual program application plan report), and noted 2 of the eight reports reviewed were submitted late. See Finding for Chart/ Table. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend JAC develop and implement procedures to ensure reports are submitted in a timely manner and in compliance with its grant agreement. A compliance calendar of all future grants reporting due dates should be maintained to assist with ensuring future compliance with reporting requirements. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 40-41.

Cash Management Federal Department – U.S. Department of Justice Pass-through Illinois Criminal Justice Information Authority Federal Award Identification Number and Year: 15JOVW-21-GG-00543-STOP and 2021 15JOVW-22-GG-00422-STOP and 2022 Violence Against Women Formula Grants, Federal Assistance Listing #16.588 County Department – State’s Attorney Office Finding 2024 – 001 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D - Post Federal Award Requirements Standards for Financial and Program Management, Section 200.305 Federal Payment (b)(3) Payments for recipients and subrecipients other than States requires that, “Reimbursement is preferred when the requirements in paragraph (b) cannot be met, when the Federal agency or pass-through entity sets a specific condition per Section 200.208, when requested by the recipient or subrecipient, when a Federal award is for construction, or when a significant portion of the construction project is accomplished through private market financing or Federal loans and the Federal award constitutes a minor portion of the project. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper.” CONDITION During the current audit period, the Cook County State’s Attorney Office (SAO) did not adequately comply with its cash management requirements in accordance with federal regulations. CAUSE Based on discussions with management, a portion of the late payments resulted from the SAO’s Program Managers being unable to provide sufficient documentation demonstrating that the delays were due to late invoice submissions by subrecipients. As a result, the Auditor could not verify whether the non-compliance was attributable to subrecipient actions. The remaining delays were due to weaknesses in the payment processing system, which relied heavily on email communications between involved parties. These emails, initiated by the Accounts Payable Processor, were not acted upon in a timely manner, resulting in payments being processed well over the thirty (30) days after initial submission. EFFECT The failure to pay each subrecipient for allowable costs within 30 days after receiving the subrecipient’s billing or payment request is a violation of federal regulations. This could impact the subrecipient’s ability to adequately perform its programmatic responsibilities under the program. QUESTIONED COSTS None. CONTEXT During our test of 29 subrecipients’ expenditures, we noted 17 instances where payments to the subrecipients’ were not made within 30 days after receipt of the subrecipient’s payment request. The payments were submitted late, ranging from 2 to 313 days late. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend that SAO develop and implement procedures to ensure payments to subrecipients are made within 30 days after receipt of the subrecipients billing or payment request, as required. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on page 38.

Subrecipient Monitoring Federal Department – U.S. Department of Justice Pass-through Illinois Criminal Justice Information Authority Federal Award Identification Number and Year: 15JOVW-21-GG-00543-STOP and 2021 15JOVW-22-GG-00422-STOP and 2022 Violence Against Women Formula Grants, Federal Assistance Listing #16.588 County Department – State’s Attorney Office Finding 2024 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4)Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. CONDITION During the current audit period, the Cook County State’s Attorney Office (SAO) did not adequately comply with its subrecipient monitoring requirements as required by Federal regulations. CAUSE Based on discussions with management, the cause of this finding was an inadequate understanding of sub-recipient monitoring policies and best practices. While the Department believed at the time that they were in compliance with the applicable monitoring requirements, they now recognize that their efforts did not fully meet the necessary standards. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in the inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of two (2) subrecipients (of a population of 4 subrecipients), we noted the following:  For both subrecipients, we noted documentation was not maintained to support SAO’s evaluation of the subrecipients’ risk of noncompliance and the frequency of monitoring to be conducted by SAO based on the assessed risk.  We also noted for both subrecipients, no documentation was provided to verify whether the subrecipients were required to have a Single Audit conducted, including SAO’s review of the report, and if applicable, issuance of a management decision on audit findings noted as required by 2 CFR 200.332e(3).  The SAO utilized a “Subrecipient Monitoring Checklist” (Checklist) to conduct and document its monitoring of subrecipients. Based on review, we noted the Checklist does not include evidence of who completed the monitoring, the date the actual monitoring was performed nor the subrecipient personnel with whom the monitoring results were discussed during the site visit. Also, the Checklist appears to be inaccurately completed. Specifically, we noted the Checklist noted that the results include expected corrective actions and dates for resolution. However, there was no finding or issues noted in the formal letter submitted to the subrecipient(s) after the site visit(s). IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend SAO implement procedures to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance and review of the Single audit report, as required by Federal regulations. Also, we suggest that the Checklist be accurately prepared and updated to include evidence of who completed the monitoring, the date the actual monitoring was performed, and the subrecipient personnel with whom the monitoring results were discussed during the site visit. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 38-39.

Reporting Federal Department – U.S. Department of Treasury Pass-through Illinois Department of Human Services Federal Award Identification Number and Year: SLFRP4406 and 2021 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds, Federal Assistance Listing #21.027 County Department – Justice Advisory Council Finding 2024 – 003 CRITERIA As required by the grant agreement with the State of Illinois, Department of Human Services (IDHS), Exhibit B, Deliverables. 4. Reporting Requirements, states “i. Pursuant to Paragraph 13.1 and 13.2 Cook County will submit monthly, quarterly and final Periodic Financial Reports (PFRs) in the format prescribed by IDHS. The monthly, quarterly and final Periodic Financial Reports must be submitted no later than the 15th of each month for the preceding month or quarter by email. The final year-end report (July 1st - June 30th) will be due on or before July 15th or no more than 30 days following grant termination. ii. Pursuant to Paragraph 13.1 and 13.2 Cook County will submit quarterly and final Periodic Performance Reports (PPRs) in the format prescribed by IDHS. Quarterly and Final Periodic Performance Reports are due no later than the 15th of each month for the preceding quarter by email. Quarter 1 (July 1st - September 30th) due October 15th, Quarter 2 (October 1st- December 31st) due January 15th, Quarter 3 (January 1st- March 31st) due April 15th, and Quarter 4 (April 1st- June 30th) due July 15th). The final year-end report (July 1st -June 30th) will be due on or before July 15th or no more than 30 days following grant termination. Performance reports will include a detailed account of how Cook County is ensuring compliance with 2 CFR 200.332. iii. Annual Program Application Plan: Providers are required to submit an Annual Program Application/Plan each year. Annual Program Plans for Programs exempt from 30 ILCS 708 (GATA) or during a renewal year will be due in April/May of each year for the upcoming program year.” CONDITION During the current audit period, Cook County Justice Advisory Council (JAC) did not comply with the reporting requirements as outlined in its grant agreement. CAUSE Based on discussions with management, the March 2024 monthly financial finding occurred due to reconciling actual expenditures for the 5-month grant period close-out. The quarterly performance report finding occurred due to an adjusted 30 days reporting schedule allowed verbally by the grantor. EFFECT Failure to submit reports in a timely manner could impair the grantor agency’s ability to monitor program activities and could result in the loss of grant funding. QUESTIONED COSTS None. CONTEXT During our review, we noted the IDHS grant agreement ended on June 30, 2024, which represented seven months of required reporting to be submitted during the County’s fiscal year. As a result, we reviewed a total of eight reports submitted (three monthly financial (of a population of 7 monthly reports), one quarterly financial and one quarterly performance report (of a population of 2 quarterly financial and performance reports), one final financial and one final performance report, and one annual program application plan report), and noted 2 of the eight reports reviewed were submitted late. See Finding for Chart/ Table. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend JAC develop and implement procedures to ensure reports are submitted in a timely manner and in compliance with its grant agreement. A compliance calendar of all future grants reporting due dates should be maintained to assist with ensuring future compliance with reporting requirements. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 40-41.