Criteria or specific requirement: The State prepares the Everyday Eats and Emergency Food Assistance Program Policy and Procedure Manuals, with specific requirements for eligibility, review of case files and documentation retention requirements. The County should have internal controls designed to ensure compliance with these provisions. Condition: During our testing, we noted four out of forty cases that did not have appropriate supporting documentation for program eligibility. Additionally, no formal review process has been established for eligibility files in either program; however, case reviews are taking place on an informal basis. The corrective action on the error within this case file was not taken until brought up during the audit. There were no incorrect payments made. Questioned costs: None Context: Within our sample of forty case reviews, documentation was either missing or insufficient to support the eligibility determination in four instances. While the case reviews were conducted, there is currently no established policy specifying the frequency of reviews or identifying the personnel responsible for conducting them. Cause: The County lacks a formal eligibility review policy, and due to a new system and record retention changes, some eligibility documentation was not kept. Effect: The case file did not have the correct documentation on file. Repeat Finding: No Recommendation: We recommend the County review controls and procedures surrounding the programs including review and record retention requirements. Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200. This procurement process must be documented with proper supporting documentation. Condition: The County did not have proper procurement documentation available for the contracts tested in the audit. Questioned costs: None Context: Five of the five contracts tested did not have the proper supporting documentation to demonstrate that procurement procedures were followed in accordance with the County’s procurement policy. Cause: The contracts were in process before the funding was assigned to the projects and there was turnover at the County. Effect: Failure to document the procurement process exposes the County to the risk that the County’s procurement policy was not followed before the contracts were awarded. Repeat Finding: Yes, repeat of prior year finding 2023-003. Recommendation: CLA recommends the County follow their internal procurement policy procedures and keep documentation of such procedures to ensure compliance with the federal procurement requirements. Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR 200.331(a) states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes, federal award identification, subrecipient name, subrecipient’s DUNS number, federal award identification number (FAIN), federal award date, subaward start and end date, amount of federal funds obligated, total amount of federal award, federal award project description, name of federal awarding agency, Assistance Listing (ALN) number and name, identification of whether the award is R&D and indirect cost rate for federal award. Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal control should include procedures to ensure required information is communicated prior to the issuance of the subaward. Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient. Per 2 CFR 200.332(d) through (f), pass-through entities must monitor the activities of the subrecipient, which includes reviewing financial reports required by the pass-through entity. Condition: During our testing, we noted subrecipients tested had required information omitted from the sub agreements to the subrecipients including Assistance Listing (CFDA) title and number, subrecipient’s DUNS number, Federal Award Identification Number (FAIN), identification of whether the award is research and development, and indirect cost rate for federal award. Subrecipients tested did not have evidence of the County’s evaluation of the risk of noncompliance by the subrecipients, nor was there evidence of monitoring of annual audits for the subrecipients. Internal checklists that aid in compliance were missing for certain subrecipients. Reporting requirements from the subrecipients to the County were also not met. Per 2 CFR 200.331(a)(1), pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring of the subrecipient. Questioned costs: None. Context: Five out of the five subrecipients did not include required information in subaward agreements issued to subrecipients and lacked evidence of both the evaluation of risk of noncompliance of the subrecipient and monitoring of annual audits for the subrecipients. Five of the five subrecipients were missing an internal checklist that is signed by the County Manager. Cause: Lack of sufficient controls in place to ensure that subrecipient agreements contain all required information and are monitored appropriately. Effect: Failure to communicate required information and to adequately monitor the subrecipients could result in subrecipients not properly administering the federal programs in accordance with federal regulations. Repeat Finding: Yes, repeat of prior year finding 2023-004. Recommendation: CLA recommends that the County review its procedures for communicating information to subrecipients and implement the procedures necessary to ensure information is included in the subrecipient award documents at time of funding and that appropriate monitoring is performed for each subrecipient. Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR 200.303, requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures in place to ensure the required certifications for covered contracts and subawards are received, documented, and contracts are not made with a debarred or suspended party. Condition: During our testing of five covered transactions, we noted the County did not have proper suspension and debarment documentation for the vendors and subawards selected for testing. Questioned costs: None. Context: All five covered transaction tested did not have proper supporting documentation for suspension and debarment procedures. Cause: Lack of sufficient controls in place to ensure that suspension and debarment checks were performed prior to entering into contracts. Effect: Failure to obtain the required certifications or perform verification procedures with the SAM could result in the payment of federal funds to vendors that are suspended or debarred from participation in federal assistance programs. Repeat Finding: Yes, repeat of prior year finding 2023-005. Recommendation: CLA recommends the County obtain certifications from vendors stating their organization is not suspended, debarred, or otherwise excluded from participation in federal assistance programs or document the procedures performed to verify the vendor is not identified as suspended or debarred on SAM. Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per the State of Colorado, Colorado Benefits Management System, SOC 1 Type 2 Report, covering July 1, 2023 through June 30, 2024, Complementary User Entity Controls, each county using CBMS is responsible for managing the access privileges granted to each county user. These user organizations should implement controls for authorizing user access for their application users. Condition: The County was not able to produce a listing of all application users for the full year and support that the access controls were operating as designed for the full year. Questioned costs: None Context: The County was able to produce a listing that was for 1/1/2024 -9/3/2024; however was not able to produce a listing of all users for the full 2024 year. Tested 14 selections related to granting and terminating access for the time period covered by the listing, noting no exceptions. Cause: County could not provide documentation that the controls related to access of CBMS were working as designed for the full year. Effect: User access controls could not be tested through the full year. Repeat Finding: No Recommendation: CLA recommends the County runs annual full user reports to ensure that access is being granted and terminated in a timely basis. Views of responsible officials: There is no disagreement with the audit finding.