Audit 372326

Criteria Per Uniform Guidance 2 CFR 200, the single audit reporting package, and the data collection form (SFSAC) must be submitted to the Federal Audit Clearinghouse within 30 calendar days after receipt of the auditor's report(s), or 9 months after the end of the audit period, whichever comes first. Condition/Context The SF-SAC single audit data collection form for the year ended September 30, 2024, was not submitted to the Federal Audit Clearinghouse by the required deadline by AIHEC. Cause There was a lack of established internal controls and procedures over the reporting process to ensure timely and accurate reporting. Effect AIHEC was not in compliance with federal regulations and guidelines. Auditor's Recommendation We recommend that the AIHEC puts in place a document tracking and data filing system to monitor compliance with the requirement for timely filing of the data collection forms. We also recommend that the Federal Audit Clearinghouse Data Collection form be filed as soon as possible for the fiscal year ending September 30, 2024.

Criteria As per the Computer and Information Science and Engineering Programs and Biomedical Research and Research Training Program compliance and reporting guidance, AIHEC must file final annual project and annual federal financial report by the due dates, as mentioned in the above tables. Condition/Context We noted that for fiscal year 2024, AIHEC did not submit the final annual project report on time for ALN #47.070 Computer and Information Science and Engineering Programs and ALN#93.859 Biomedical Research and Research Training Program. Cause AIHEC did not have adequate monitoring over the completion and submission of the required reports. Effect AIHEC is not in compliance with the reporting requirements, per the grant contract. Recommendation We recommend AIHEC continue to review its internal control processes, to ensure that controls are properly implemented for the reporting requirement and that adequate documentation is maintained.

Criteria 2 CFR 200.303 requires that the non-Federal entity must "(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the comptroller General of the United States and the "Internal Control Intergrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Uniform Guidance 2 CFR Section 200.320 (a)(2) states regarding the applicability of simplified acquisition procedures: "The aggregate dollar amount of the procurement transaction is higher than the micro purchase threshold but does not exceed the simplified acquisition threshold. If simplified acquisition procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources. Unless specified by the Federal agency, the recipient or subrecipient may exercise judgment in determining what number is adequate." Per procurement policy of AIHEC requires that for procurement by small purchase ($10,000 - $249,000), where the aggregate dollar amount is higher than the micro-purchase threshold, price or rate quotations must be obtained from three qualified sources. If three separate qualified sources cannot be obtained the reason needs to be formally documented. Condition/Context For procurement transaction tested, we noted that AIHEC did not complete a sole-source justification form timely to support the vendor that was selected. Cause Management does not have sufficient internal controls in place to ensure that AIHEC's procurement policies are followed for all procurement transactions prior to entering the procurement. Effect AIHEC entered into a procurement that did not go through a competitive solicitation process. Recommendation Management should review its policies and procedures to ensure all procurement transactions are in accordance with AIHEC's procurement policies and have the appropriate supporting documentation.

Criteria In accordance with the Uniform Guidance Section 200.332(b), 200.332(d), and 200.332(f), Requirements for Pass-Through Entities, pass-through entities must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Pass-through entities must also monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include; (1) reviewing financial and performance reports required by the pass-through entity; (2) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means; and (3) issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity. Additionally, pass-through entities must verify that every subrecipient is audited as required by Subpart F – Audit Requirements when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in Section 200.501. Condition/Context During our testing of subrecipient monitoring, AIHEC was unable to provide documentation for any of the subrecipients indication that a formal risk assessment had been conducted. Cause AIHEC has not implemented sufficient internal controls or monitoring procedures to oversee the subrecipient's activities effectively. Effect AIHEC is not in compliance with federal requirements related to subrecipient monitoring. Recommendation We recommend that AIHEC implement the necessary internal controls to ensure effective subrecipient monitoring through risk assessments. AIHEC should establish comprehensive procedures to identify all subrecipient expenditures that correspond to federal grants.