Audit 370264

2024-003: Suspension and Debarment Verification Assistance Listing Number (ALN) and Title: 20.205 Highway Planning and Construction Federal Grantor: U.S. Department of Transportation (DOT) Passed-through: Oregon Department of Transportation (ODOT) Award Identification Numbers and Years: Finding is applicable to all 20.205 awards on the SEFA for 2024 Compliance Requirement: Procurement and Suspension and Debarment Type of Finding: Significant Deficiency in Internal Control over Compliance Prior Year Audit Finding: No Criteria: 2 CFR 200.214 prohibits non-federal entities from contracting with or making subawards to parties listed on the governmentwide suspension and debarment list. 2 CFR 200.318(h) requires non-federal entities to verify that vendors are not suspended or debarred before entering into covered transactions (e.g., procurements expected to equal or exceed $25,000). This verification is typically done by checking the System for Award Management (SAM.gov) or collecting a certification from the entity. Prudent practice and effective internal control require documentation of these verification procedures and results. Condition: LCOG did not maintain documentation to demonstrate that it verified whether certain vendors paid with ALN 20.205 funds were excluded or disqualified under the suspension and debarment rules. While management stated they performed reviews of the SAM.gov listing prior to expenditure, no evidence (such as dated screenshots, search results printouts, or certifications) was available to support that the required verifications were performed for tested vendors. Questioned Costs: None. Context: During compliance testing for ALN 20.205, we selected a sample of two covered transactions. No other covered transactions were procured during FY 2024. LCOG could not provide documentation of its verification process for one the vendors in these transactions. Subsequent review of SAM.gov performed during the audit did not indicate the vendor had been suspended or debarred. Cause: LCOG has not implemented formal procedures requiring the retention of documentation demonstrating suspension and debarment checks for vendors paid with federal funds. Effect: Without documented verification, LCOG cannot demonstrate compliance with federal suspension and debarment requirements. While no ineligible vendors were identified in our sample, the lack of documented procedures and evidence represents a failure in the design or operation of internal controls, increasing the risk that LCOG could inadvertently contract with a suspended or debarred party using federal funds in the future. Recommendation: We recommend LCOG establish and implement formal, documented procedures for verifying that vendors are not suspended or debarred before entering into covered transactions paid with federal funds. These procedures should specify the method of verification (e.g., checking SAM.gov) and require retention of evidence (e.g., dated printouts or screenshots of the search results) within the procurement or vendor files. Auditee Views: The suspension and debarment check during the procurement process is one of the steps completed by the Procurement Officer for any covered transaction that is not the subject of a formal procurement. The Executive Director completed this check. For the one vendor referenced above, a sole source contract was to be awarded and the check for suspension and debarment of the vendor was completed by reviewing entity records in SAM.gov. The review of SAM.gov records did not disclose any suspensions or debarments of the vendor. In the future, we will take a screen shot of the result and place it in the procurement file. This will become part of the process immediately for any procurements that are not formal RFPs. Formal RFPs require vendors to certify that they are not suspended or debarred.

2024-004: Subrecipient Determination and Monitoring Assistance Listing Number (ALN) and Title: 20.205 Highway Planning and Construction Federal Grantor: U.S. Department of Transportation (DOT) Passed-through: Oregon Department of Transportation (ODOT) Award Identification Numbers and Years: Finding is applicable to all 20.205 awards on the SEFA for 2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Noncompliance and Material Weakness in Internal Control over Compliance. Prior Year Audit Finding: No Criteria: 2 CFR 200.331 requires pass-through entities (PTEs) like LCOG to make case-by-case determinations whether an agreement casts the party receiving funds as a subrecipient or a contractor (vendor). This determination affects reporting on the SEFA (§200.510(b)(4)). Furthermore, 2 CFR 200.332 requires PTEs to evaluate each subrecipient's risk of noncompliance, monitor their activities to ensure compliance with federal requirements (including reviewing financial and performance reports), and verify that subrecipients subject to the Single Audit requirements have obtained the required audit and take appropriate action on any findings effecting the pass-through program (§200.332(b), (d), and (f)). Effective internal controls should ensure proper classification and that required monitoring activities are performed and documented. Condition: LCOG exhibited weaknesses in its process for determining and monitoring subrecipients under ALN 20.205. Specifically:  LCOG did not correctly classify entities receiving funds. Multiple vendors were incorrectly identified as subrecipients on the draft SEFA provided for audit.  Two entities meeting the definition of subrecipients were identified during audit procedures; however, LCOG had classified them as vendors and omitted them from the draft SEFA. As a result of misclassifying the actual subrecipients as vendors, LCOG did not perform required subrecipient monitoring activities for these entities, such as conducting and documenting a risk assessment or obtaining and reviewing their Single Audit reporting packages. Questioned Costs: None. Context: The misclassifications were identified during audit testing and review of the draft SEFA. While the entities omitted from the SEFA were later confirmed to be subrecipients, LCOG had not performed the required monitoring steps during the fiscal year. Subsequent review of the Single Audit reports for these two subrecipients during the audit process confirmed they had correctly reported the funds received from LCOG and disclosed no audit findings related to this program. No errors were noted in the initial contracting process with these entities. However, the lack of contemporaneous monitoring represents noncompliance and a control weakness. Cause: LCOG lacks adequate procedures for performing and documenting the subrecipient vs. contractor determination based on the criteria in 2 CFR 200.331. This initial failure led to inaccurate SEFA reporting and the subsequent failure to implement required monitoring protocols for entities that were, in fact, subrecipients. Effect: The failure to correctly identify and monitor subrecipients constitutes noncompliance with 2 CFR 200.332 and resulted in inaccurate SEFA reporting. Although no subrecipient noncompliance impacting the program was ultimately identified in this instance, the absence of required monitoring activities (including risk assessment and review of audit reports) creates a risk that subrecipient noncompliance could occur and not be detected by LCOG in a timely manner. This condition represents a material weakness in internal control over compliance. Recommendation: We recommend LCOG implement procedures to: 99  Formally document the determination of whether entities receiving federal funds are subrecipients or contractors prior to entering into agreements and preparing the SEFA, using the criteria in 2 CFR 200.331.  Develop and implement a risk-based monitoring plan for all identified subrecipients, ensuring that required monitoring activities (including review of reports and Single Audits, where applicable) are performed and documented throughout the period of performance.  Ensure the SEFA accurately reflects subrecipient relationships and amounts passed through. Auditee Views: While we agree that we did not have a formal monitoring plan in place, now that we are aware of the need for such a plan, we will put a plan in place immediately. Once we became aware, we immediately reviewed the single audit reports all subrecipients. As to whether all subrecipients were properly reported on the SEFA, LCOG and ODOT had been in discussions for several months over whether certain entities contracted by LCOG under the Secure Routes to Schools program were, in fact, subrecipients and was unclear due to conflicting guidance received from various individuals. We will begin consulting with ODOT prior to the audit to make sure they agree with the classification of fund recipients as either contractor or subrecipient.