FINDING NO. 2024-002: PROGRAM REPORTS AND ACCOUNTING RECORDS Repeated Finding: Yes Criteria: As more fully described in finding 2024-005, the subrecipient agreement between the Bank and the Puerto Rico Department of Housing (PRDOH), establishes in the Terms and Conditions Part IV. Performance, Monitoring and Reporting, Section B. Reporting, that the Bank as Subrecipient shall submit monthly progress reports to the PRDOH, on the form and with the content to be specified and required by the PRDOH. Also, the CDBG-DR Financial Policy of the PRDOH establishes that the Bank, as subrecipient is responsible for ensuring that separate accounting is maintained for CDBG-DR funds in its internal accounting system and records. Condition: As described in finding 2024-005: For the year ended June 30, 2024, we compared the amount of grants awarded as per the Administrative and Performance Reports submitted to the PRDOH with the amount reported in the Schedule of Expenditures and Federal Awards and noted an unreconciled difference of $25,766,191. In relation to the CDBG-DR Fund, although disbursements are recorded in a separate fund, the Bank does not present, on a monthly basis, the revenues, expenses, assets, and liabilities in the Bank’s general ledger. Instead, the Bank is recording the transactions as revenues, expenses, assets, and liabilities related to the CDBG-DR fund at year end. The CDBG-DR fund activity is monitored in another system that is maintained parallel to the Bank’s general ledger. This additional system is used for the reporting process but is not monitored and reconciled jointly with the Bank’s general ledger. Entity level controls related to monthly approvals, reconciliations, actual versus budget comparisons, and other financial reporting controls are performed in another system that does not make automatic interface with the Bank’s general ledger. We noted the following situations related to accounting records for the year ended June 30, 2024: The trial balance provided by management for audit procedures relating to CDBG-DR funds had not been reconciled with the subsidiary records for grant expenditures, including both direct and indirect costs. The Bank does not maintain accurate subsidiary records for key financial components in relation to previous and current year such as CDBG-DR receivables, payables, and inter-fund balances. The reconciliation of CDBG-DR accounts for the fiscal year ending June 30, 2024, was completed by the Bank’s management a year after closing as part of the audit process. This included the preparation of subsidiary records for the related receivables, payables, and inter-fund balances and the recording into the Bank’s general ledger. Cause: The observations noted in finding 2024-005 appear to be largely due to the effect of the lack of monthly presentation of transactions of CDBG-DR Fund transactions in the general ledger and related reconciliations of general ledger with subsidiaries and related program reports. Also, a lack of programs and data interphase communication between the Bank’s Financial and Federal Programmatic Divisions does not permit the accurate and prompt reconciliation of the CDBG-DR accounting records, reports, and subsidiaries. Effect: Refer to finding 2024-005 for the effect of this observation. This resulted in a material weakness in the internal control related to the CDBG-DR Fund transactions in general ledger and related reconciliations. Recommendation: Refer to finding 2024-005 for the recommendation for the observations associated with this finding.
FINDING NO. 2024-003 GRANT AWARDS REVIEW Repeated Finding: Yes Criteria: As more fully described in finding 2024-004, the subrecipient agreement between the Bank and the Puerto Rico Department of Housing (PRDOH), establishes in the Terms and Conditions that the Bank, as Subrecipient, shall comply with applicable PRDOH’s policies and guidelines as established in Program Guidelines and their amendments, if any, which made an integral part of the subrecipient agreement. Condition: As described in finding 2024-004, during our examination, we performed different audit testing to validate compliance with criteria described above. From a total of 974 SBF Program Recovery Grants (the grants) awarded to business applicants during the year ended June 30, 2024, in the amount of $66,108,871, we performed a grant award test to validate various compliance requirements for the grant. We selected a sample of sixty-one (61) grants awarded as follows: sixteen (16) awarded for working capital purposes, fourteen (14) awarded for working capital and equipment and thirty-one (31) grants awarded for the purchase of equipment, in total amount of $3,630,774. In addition, we performed a closeout test to validate procedures surrounding closeout of the grant. We selected a sample of sixty-one (61) cases, in the total amount of $3,598,259 from a total of 1,911 grants awarded amounting to $99,766,799 for which closeout procedures were completed during the year ended June 30, 2024. Also, we performed a recapture of funds test to validate procedures surrounding recapture of grant funds. We selected a sample of twenty-five (25) cases, in the total amount of $906,561 from a total of 318 grants awarded amounting to $11,492,282 for which recapture of funds were completed during the year ended June 30,2024. As more fully described in finding 2024-004, we noted the following: - Amount Awarded Computed Incorrectly - Incorrect Data in Grant Management System of Record for the Grants - Missing Documents in Grant Management System of Record for the Grants - Inadequate Documentation and Implementation of Procedures Cause: Management has not consistently applied procedures as described in the Bank’s policies for underwriting, duplication of benefits, expenditure review and closeout as more fully described in finding 2024-004. Effect: Refer to finding 2024-004 for the effect of this observation. Recommendation: Refer to finding 2024-004 for the recommendation for the observations associated with this finding.
FINDING NO. 2024-004 GRANT AWARDS DISBURSEMENTS Federal Agency: U.S. Department of Housing and Urban Development Federal Program: Federal Financial Assistance Listing 14.228 Community Development Block Grants/State’s Program and Non- Entitlement Grants in Hawaii Federal Award No: B-18-DP-72-0001 Compliance Requirement: Activities Allowed or Unallowed Allowable Costs / Cost Principles Questioned Costs: None Repeated Finding: Yes Criteria: The subrecipient agreement between the Bank and the Puerto Rico Department of Housing (PRDOH), establishes in the Terms and Conditions the following: Part III. Scope of Work, Section A. Subrecipient Management Responsibilities, Number 2, that all services shall be made in accordance with PRDOH guidelines, HUD guidelines and regulations, and other applicable state and federal laws and regulations. Part X. Compliance with Federal Statutes, Regulations and the Terms and Conditions of the Federal Award and Additional PRDOH Requirements: Section A. General Compliance - that the Bank as Subrecipient shall also comply with applicable PRDOH’s policies and guidelines as established in Program Guidelines and their amendments, if any, which made an integral part of the subrecipient agreement. Section H. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards - that the Bank as Subrecipient, shall comply with the applicable provisions in 2 C.F.R. part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards 2 C.F.R. part 200. 2 C.F.R. part 200.303 establishes that a non-Federal entity must: 2 C.F.R. 200.303 (a) - Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 C.F.R. 200.303 (d) - Take prompt action when instances of noncompliance are identified in audit findings. Conditions and Context: During our examination, we performed different audit testing to validate compliance with criteria described above. From a total of 974 Small Business Financing (SBF) Program Recovery Grants (the grants) awarded to business applicants during the year ended June 30, 2024, in the amount of $66,108,871, we performed a grant award test to validate various compliance requirements for the grant. We selected a sample of sixty-one (61) grants awarded as follows: sixteen (16) awarded for working capital purposes, fourteen (14) awarded for working capital and equipment and thirty-one (31) grants awarded for the purchase of equipment, in the total amount of $3,630,774. In addition, we performed a closeout test to validate procedures surrounding closeout of the grant. We selected a sample of sixty-one (61) cases, in the total amount of $3,598,259 from a total of 1,911 grants awarded amounting to $99,766,799 for which closeout procedures were completed during the year ended June 30, 2024. Also, we performed a recapture of funds test to validate procedures surrounding recapture of grant funds. We selected a sample of twenty-five (25) cases, in the total amount of $906,561 from a total of 318 grants awarded amounting to $11,492,282 for which recapture of funds were completed during the year ended June 30, 2024. Amount Awarded Computed Incorrectly Based on the results of our grant award testing, we recomputed the amount of the grant awarded, and noted that in one (1) case, representing approximately 2% of the total sample, the amount of the award was computed incorrectly. The average quotation cost used for the acquisition of equipment, was computed in the amount of $12,163, instead of $11,622. Missing Documents in Grant Management System of Record for the Grants Based on the results of our examination, we noted certain exceptions where documents were missing in the Grant Management System of Record for the Grants (Canopy) or the document had missing information. The situations noted were as follows, classified by the test performed. Grant Award Procedures Testing: For the grants awarded for equipment, we reviewed the supporting documentation for required quotes and noted that in thirteen (13) cases, or approximately 29%, the quotes provided by the Business Applicants did not have the document date. For one (1) case, representing approximately 2% of total sample, we reviewed the support documentation required for eligible equipment and noted that for one item requested the eligible cost surpassed the $10,000 threshold for the requirement of (3) three vendors quotations. However, just one quote was obtained. For fifty-seven (57) cases, representing approximately 93% of total sample, we noted that the SBF Acknowledgement of Receipt and Certification Guidance (Task 4 for the closeout phase) was not found in Canopy. Closeout Procedures Testing: For three (3) cases, representing approximately 5% of total sample, the applicant’s duplication of benefits certification used in the Expenditure Review & Closeout Process, was not found. Instead, we found the following: the review of the bank statements (one case), a note (one case) and in other case we noted that the certification was uploaded in May 2025. For one (1) case, representing approximately 2% of total sample, no sufficient evidence was provided to validate utilities expense. Applicant submitted a letter from the landlord as a receipt without the invoice for the utilities. Expense amounted to $1,768. For two (2) cases, representing approximately 3% of total sample, the grant award agreement was not located on file. The document was found in the grant award extension file. Incorrect Data in Grant Management System of Record for the Grants As a result of our audit procedures, we noted several instances where the information in the Grant Management System of Record was inaccurate. The situations noted were as follows, classified by the test performed. Closeout Procedures Testing: For two (2) cases, representing approximately 3% of total sample, we could not validate the eligibility review start date. The data disclosed in this field on the first application was the date of the grant award extension. For two (2) cases, representing approximately 3% of total sample, the applicant did not comply with the period of reporting for the Third Low and Moderate Income (LMI) as established in the Program's Guidelines. Subsequently, we noted that the original date, that should not be changed, was changed in the Canopy file. For one (1) case, representing approximately 2% of total sample, closeout procedures were completed, but the status in Canopy appeared as "Pending Closeout Confirmation". During our evaluation of the report provided for closeout procedures, we noted that twenty-three (23) cases appeared with a Notice of Compliance Letter sent date during the period under audit (July 1, 2023 to June 30, 2024), but the disbursement date was made from June 2024 through November 2024. Notice of compliance letter should be dated after the date of disbursement. In addition, the Closeout Status was "Closing Team Case Manager (CM) Review in Progress". Recapture of Funds Testing: During our evaluation of the recapture of funds report, we noted that for one (1) case the grant amount as per the grant award agreement does not agree with the amount as included in the recapture of funds report provided for audit purpose. The difference amounted to $42,195. Inadequate Documentation and Implementation of Procedures As a result of our audit procedures, we noted several instances where the procedures were not completed or properly documented in Canopy. The situations noted were as follows, classified by the test performed. Closeout Procedures Testing: For five (5) cases, representing approximately 8% of total sample, the First LMI Form was not provided by the Applicant in the period established. The period of reporting must be during the Eligibility Review phase. For one (1) case, representing approximately 2% of total sample, the Second LMI Form was not provided by the Applicant in the period established. Period of reporting must be during the Award Coordination phase. For nine (9) cases, representing approximately 15% of total sample, the third LMI Form was not provided by the Applicant in the period established. Period of reporting must be completed during the Expenditure and Closeout phase. The Case Manager is required to comply with the following notifications to the Applicant: a) First Receipts Review Reminder; b) Subsequent Receipt Review Reminder to applicants after 30 days following disbursement date. - For forty-four (44) cases, representing approximately 72% of total sample, there was no evidence of reminder sent to the Applicant. - For thirteen (13) cases, representing approximately 21% of total sample, the reminder was sent to Applicant, but not in the first 30 days after disbursement. Recapture of Funds Testing: For four (4) cases, representing approximately 16% of total sample in which, the applicant did not return the funds within the 30-day period, did not provide adequate documentation nor request a program administrative reconsideration. The cases were not referred to PRDOH Legal Division as established in the guidelines. For one (1) case, representing approximately 4% of total sample in which, the applicant did not return the funds within the 30-day period or provided adequate documentation. Also, the program reconsideration was denied. The case was not referred to PRDOH Legal Division as established in the guidelines. Cause: Management has not consistently applied procedures as described in the Bank’s policies for underwriting, duplication of benefits, expenditure review and closeout, and recapture of funds to ensure compliance with requirements. In addition, for applications with grant award extension, the Bank requested the program administrator to duplicate files to avoid entering basic information for the same application. This matter caused the information between both applications to be mixed between first application and grant award extension. Effect: The Bank did not consistently comply with procedures of work performed as detailed in the policies and procedures to ensure amounts awarded incorrectly and missing documents in Grant Management System of Record are promptly identified and corrected. This resulted in a significant deficiency in internal controls of grant award process. In addition, the Bank needs to ensure as part of the closeout procedures that information included in the file belongs to the case being evaluated and any change in the information that does not agree with the application is properly investigated and corrected with the appropriate supporting documentation. Any change for the application needs to be properly documented in the notes for the case to ensure proper audit trail for any subsequent review. Recommendation: Management must establish internal controls that permit the proper detection of any instance of non- compliance with policies and procedures established for the underwriting, duplication of benefits, expenditure review and closeout, and recapture of funds of the grant. By doing so, the Bank will avoid falling in noncompliance with federal requirements and the terms and conditions as established in the subrecipient agreement.
FINDING NO. 2024-005 PROGRAM REPORTS AND ACCOUNTING RECORDS Federal Agency: U.S. Department of Housing and Urban Development Federal Program: Federal Financial Assistance Listing 14.228 Community Development Block Grants/State’s Program and Non- Entitlement Grants in Hawaii Federal Award No: B-18-DP-72-0001 Compliance Requirement: Reporting Questioned Costs: None Repeated Finding: Yes Criteria: The subrecipient agreement between the Bank and the Puerto Rico Department of Housing (PRDOH), establishes in the Terms and Conditions Part IV. Performance, Monitoring and Reporting, Section B. Reporting, that the Bank as Subrecipient shall submit regular monthly progress reports to the PRDOH, on the form and with the content to be specified and required by the PRDOH. Moreover, the subrecipient agreement between the Bank and the PRDOH, establishes in the Terms and Conditions Section Part III-Scope of Work, sub-section A. (2), that all services shall be made in accordance with PRDOH guidelines, HUD guidelines and regulations, and other applicable state and federal laws and regulations. The CDBG-DR Financial Policy of the Puerto Rico Department of Housing, (the Financial Policy), in its Part 7 Accounting Records and Systems, Section 7.1.2 Subrecipient Accounting Records, establishes that the Bank as subrecipient is responsible for ensuring that separate accounting are maintained for CDBG-DR funds in its internal accounting system and records. These records should, to the extend possible, be developed to be consistent with PRDOH CDBG-DR general accounting and recordkeeping policies. Also, the Financial Policy in its Part 13 Reconciliations, establishes that the Bank as subrecipient, must have procedures in place to reconcile accounts and reports by comparing revenues and expenditures against disbursements for CDBG- DR funded activities. The subrecipient must: Maintain in its accounting records the amounts budgeted for eligible activities. Compare actual obligations and expenditures to date against planned obligations and expenditures: and Report deviations from budget and program plans and request approval for budget and program plan revisions. The Code of Federal Regulations, 2 C.F.R., Part 200, Subpart D, Section 200.302 (b) (2), establishes that the financial management system of each non-Federal entity must provide for accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. Condition and Context: Monthly Reporting The Bank uses the Grant Compliance Portal (GCP) to submit Administrative and Performance Reports to the PRDOH. The GCP is a performance reporting system created for PRDOH to monitor regular monthly progress by the subrecipient for administrative and performance activities. The GCP is independent of other systems used for the underwriting, approval, closeout and billing of the grants to PRDOH. As such, requires the manual input of the information monthly. Once the Bank completes the information in the GCP, it is reviewed by PRDOH. Review notes related to the performance of the Bank are added before finalizing the report. The signed report by all the points of contact is kept by the Bank as evidence of compliance with the submission of the Administrative and Performance Reports by the due date. We compared the amount of grants awarded as per the Administrative and Performance Reports submitted to the PRDOH with the amount reported in the Schedule of Expenditures and Federal Awards as of June 30, 2024. We noted a difference of $25,766,191 due to grants awarded from January 2024 through June 2024 were not reflected in the Administrative and Performance Reports. This caused a discrepancy in the cumulative actual total amount of grants awarded for the year that impacts the results in the monitoring of performance by PRDOH. The Bank needs to reconcile the figures with the accounting system to confirm the information for the period is properly reflected in the Administrative and Performance Reports before the submission of the report to ensure the monitoring performed by PRDOH is based on correct and reliable information. Accounting Records and Reconciliations In relation to the CDBG-DR Fund, although disbursements are recorded in a separate fund, the Bank does not present, on a monthly basis, the revenues, expenses, assets, and liabilities in the Bank’s general ledger. Instead, the Bank is recording the transactions as revenues, expenses, assets, and liabilities related to the CDBG-DR fund at year end. The CDBG-DR fund activity is monitored in another system that is maintained parallel to the Bank’s general ledger. This additional system is used for the reporting process but is not monitored and reconciled jointly with the Bank’s general ledger. Entity level controls related to monthly approvals, reconciliations, actual versus budget comparisons, and other financial reporting controls are performed in another system that does not make automatic interface with the Bank’s general ledger. The trial balance maintained by management for internal and external reporting related to CDBG-DR funds had not been reconciled with the subsidiary records for grant expenditures, including both direct and indirect costs. Cause: The management of the Bank has not implemented effective internal control procedures that permit the proper reconciliation of the amount of grants awarded per accounting records with the amounts disclosed in the Administrative and Performance Reports. Effect: The absence of proper internal controls in the areas of program reports and accounting records causes the Bank to fall in noncompliance with federal reporting requirements and the terms and conditions as established in the subrecipient agreement. This matter may result in material differences or errors that could not be detected and resolved on a timely basis and consequently we consider that the above conditions are material weaknesses in internal control over compliance. Recommendation: The Bank should ensure, specifically to the CDBG-DR Fund, that adequate procedures and internal controls related to monthly review, reconciliation and approval are in place to ensure that proper monthly accounting is maintained and that the awarded grants per accounting records are reconciled and agreed to the balances as disclosed in the Administrative and Performance Reports. Evidence of such reconciliations must be maintained as support for the reconciliation procedures performed.
FINDING NO. 2024-006 PROCUREMENT AND CONTRACTOR OVERSIGHT Federal Agency: U.S. Department of Housing and Urban Development Federal Program: Federal Financial Assistance Listing 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii Federal Award No: B-18-DP-72-0001 Compliance Requirement: Special Tests and Provisions Questioned Costs: None Repeated Finding: No Criteria: The subrecipient agreement between the Bank and the Puerto Rico Department of Housing (PRDOH), established in the Terms and Conditions Section Y. Conduct, Subsection 1. Contracts, under letter e. Notification, the following: “The Subrecipient shall notify and provide a copy of any and all contracts related to this agreement and CDBG-DR funds to the Contracts Administration Area of the CDBG-DR Legal Division within three (3) days of its execution”. Conditions and Context: During our audit procedures over the special tests and provisions, it was observed that the Bank entered into an agreement with a third party on June 13, 2023. The Bank submitted the agreement and its amendment to the PRDOH CDBG-DR Legal Division on September 21, 2023, three months past the execution date. Cause: Management has not consistently applied procedures as described in the “Conduct Section” to ensure compliance with special requirements. Effect: The Bank did not comply with notifying and providing a copy of the awarded subcontracts to PRDOH CDBG- DR Legal Division within the established period. Recommendation: Management must establish internal controls that permit the proper detection of any instance of non- compliance with the special requirements. By doing so, the Bank will avoid falling in noncompliance with federal requirements and the terms and conditions established in the subrecipient agreement.
FINDING NO. 2024-007 SINGLE AUDIT REPORT Federal Agency: U.S. Department of Housing and Urban Development Federal Program: Federal Financial Assistance Listing 14.228 Community Development Block Grants/State’s Program and Non- Entitlement Grants in Hawaii Federal Award No: B-18-DP-72-0001 Compliance Requirement: Special Tests and Provisions Questioned Costs: None Repeated Finding: Yes Criteria: The subrecipient agreement between the Bank and the Puerto Rico Department of Housing (PRDOH), establishes in the Terms and Conditions Part X. Compliance with Federal Statutes, Regulations and the Terms and Conditions of the Federal Award and Additional PRDOH Requirements, Section P. Single Audit, that the Subrecipient must be audited as required by 2 C.F.R. part 200, subpart F when it is expected that the Subrecipient’s Federal awards expended during the respectively fiscal year equaled or exceeded the threshold set forth in section 200.501 Audit Requirements. The 2 C.F.R 200.501 (a) establishes that non-Federal entity that expends $750,000 or more during the non- Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. The 2 C.F.R 200.512 (a) (1) establishes that the audit must be completed and the data collection form described in paragraph (b) of this section and reporting package described in paragraph (c) of this section must be submitted within the earlier of 30 calendar days after receipt of the auditor’s report(s), or nine months after the end of the audit period. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. Condition and Context: The Single Audit Report of the Bank for the fiscal year ended June 30, 2024, was not submitted on or before March 31, 2025, as required by the Uniform Guidance. The Single Audit related to such period was completed after the 9 months deadline. Cause: Information to complete the financial statements audit procedures was not available within the required period. Effect: Noncompliance with the above-mentioned requirements could lead to administrative actions by the grantor, representing a significant deficiency in internal control over compliance. Recommendation: Data collection form and single audit package shall be submitted within the required due date.