2024-008 Federal Agencies: U.S. Department of Agriculture Federal Program Names: The Child Nutrition Cluster: National School Lunch Program Summer Food Service Program Assistance Listing Numbers: 10.555 10.559 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2023 through June 30, 2024 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria: Uniform Guidance requires recipients to submit accurate, complete, and timely financial and performance reports for federal awards (2 CFR 200.327 and 200.328). Program specific reporting instructions for the Child Nutrition Cluster require the FNS 10 and FNS 418 to be filed within 30 days after month end. Condition: As part of the reporting requirements for the CBS Food Program under the National School Lunch Program (NSLP) and Summer Food Service Program (SFSP), management is responsible for submitting the FNS 10 (NSLP) and FNS 418 (SFSP) reports within 30 days after month-end. However, management was unable to provide five (5) monthly NSLP reports and one (1) monthly SFSP report requested for audit testing. Questioned Costs: None Cause: Management did not maintain adequate internal controls to ensure that required monthly program reports were properly completed, retained, and available for audit. This may include weaknesses in recordkeeping processes, staff turnover, or insufficient monitoring of reporting deadlines. Effect: Failure to maintain and provide required federal reports results in noncompliance with federal reporting requirements. Because key source documents were unavailable, auditors were unable to verify the accuracy, completeness, and timeliness of reported program activity for those months. This increases the risk of misreporting or unsupported claims being submitted to the federal government. Recommendation: The Organization should establish and enforce strengthened internal controls over federal reporting to ensure that all required monthly reports (FNS 10 and FNS 418) are: (a) completed accurately, (b) submitted on time, and (c) retained in accordance with federal record retention requirements (2 CFR 200.334). Management should designate responsible personnel and implement a monitoring process to ensure compliance. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan
2024-004 Federal Agencies: U.S. Department of Agriculture Federal Program Names: The Child Nutrition Cluster: National School Lunch Program Summer Food Service Program Child and Adult Care Food Program Assistance Listing Numbers: 10.555 10.559 10.558 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2023 through June 30, 2024 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria: Per 2 CFR 200.430 (“Compensation—personal services”), compensation charged to federal awards must be accurately documented, supported by appropriate records, and approved in accordance with established personnel policies. Additionally, federal program agreements—including the Commonwealth of Pennsylvania’s SFSP contract—require that any additional employee compensation charged to the award must be authorized, supported by documentation, and allowability must be verifiable. Internal control requirements under 2 CFR 200.303 mandate entities to establish and maintain effective controls over payroll processing, including documented approval of pay rate changes and personnel actions. Condition: As part of our audit procedures, we selected a sample of 40 payroll transactions for review. This process included examination of employee human resource files (such as signed W-4 and I-9 forms), management-approved pay rates, time sheets with supervisory sign-off, and corresponding payroll reports. We recalculated total hours per timesheet using the employees' pay rates and compared these figures to the relevant payroll reports. During our review, we observed that two employees received additional compensation ranging from $25 to $75 for undertaking extra responsibilities related to the administration of the CBS Food Program’s Summer Food Service Program by the former Chief Executive Officer. Management was unable to provide supporting documentation evidencing approval by the former Chief Executive Officer or confirmation from the Commonwealth of Pennsylvania, Department of Education, indicating that such additional compensation complied with the contractual agreement governing the Summer Food Service Program. Additionally, of the 40 payroll transactions sampled, we noted one employee’s required payroll change documentation (e.g., an approved payroll change form) was not present in their personnel file. Questioned Costs: None Cause: Management did not consistently maintain or enforce internal controls over payroll documentation, including the requirement for retaining approval of supplemental compensation and payroll change forms. Additionally, there was no centralized electronic document management system to ensure secure and consistent retention of personnel and payroll support. Effect: Without proper documentation and approval, the Organization may have charged unallowable or inadequately supported compensation to the federal program. Payroll changes could be processed without appropriate authorization, increasing the risk of errors or unauthorized transactions. The lack of adequate payroll documentation may lead to questioned costs and reduce the reliability of payroll charges reported to the federal awarding agency. Recommendation: We recommend that management improve internal controls for payroll authorization by making sure every payroll change form and supplemental compensation approval is filled out, approved, and kept on file. Introducing a central electronic document management system will help securely store records, standardize documentation, and create clear audit trails for all payroll and personnel files. Management should also regularly review payroll records to confirm that all necessary paperwork, such as personnel forms, pay rate approvals, and backup for extra pay, is included. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan.
2024-005 Federal Agencies: U.S. Department of Agriculture Federal Program Names: Child and Adult Care Food Program Assistance Listing Numbers: 10.558 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2023 through June 30, 2024 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria: Under CACFP program requirements, participating organizations must maintain complete and accurate eligibility documentation for all individuals receiving free or reduced price meals. Eligibility must be supported by appropriate verification of household income or evidence that the participant receives assistance from another qualifying federal program. These records must be current, complete, and available for audit review. Condition: During our testing of participant eligibility, we selected a sample of 40 participants receiving meals at centers contracted with the CBS Food Program. For 2 of the 40 participants, management was unable to provide complete and valid eligibility documentation. In one instance, the only available eligibility form had been prepared in a future fiscal year, and in another instance, the eligibility form could not be located at all. Questioned Costs: None Cause: The organization’s existing process for maintaining and managing CACFP eligibility documentation is not sufficiently controlled to ensure that all required forms are collected, retained, and maintained in accordance with federal program requirements. Contributing factors may include inadequate file management procedures, insufficient staff oversight, or the absence of a documented monitoring and follow up process for missing or inconsistent forms. Effect: Failure to maintain complete and accurate eligibility documentation increases the risk of ineligible participants being claimed for reimbursement, which could result in questioned costs, repayment obligations, or findings by federal or pass through oversight agencies. In addition, incomplete participant files limit management’s ability to demonstrate compliance with federal eligibility requirements and may affect future program funding. Recommendation: We recommend that management strengthen its CACFP eligibility documentation procedures to ensure that all required forms are properly completed, collected, and retained for every participant. This should include implementing a standardized intake process, maintaining timely reviews to confirm completeness of eligibility files, and developing a tracking or monitoring system to identify missing or outdated documentation. Management should also reinforce internal expectations for timely updating of eligibility files and ensure staff are trained on CACFP documentation requirements. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan.
2024-006 Federal Agencies: U.S. Department of Agriculture Federal Program Names: The Child Nutrition Cluster: National School Lunch Program Summer Food Service Program Child and Adult Care Food Program Assistance Listing Numbers: 10.555 10.559 10.558 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2023 through June 30, 2024 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria: According to 2 CFR § 200.213, non-federal entities must ensure that they do not enter into contracts or subcontracts with parties that are suspended or debarred from participating in federal programs. This requires verification of the status of potential contractors or subcontractors by checking the federal government's System for Award Management (SAM). Additionally, 2 CFR § 180 provides guidelines for agencies to follow in implementing the governmentwide debarment and suspension system. Condition: As part of our procurement testing in accordance with Uniform Guidance requirements, we requested that management provide the most recent suspension and debarment assessments for the vendors selected for review. Our analysis indicated that management did not perform these assessments by reviewing the federal government's suspended or debarred vendor list on SAM.gov. Rather, management relied on vendor certifications obtained through the Commonwealth of Pennsylvania, Department of Education, to determine vendor eligibility with respect to suspension or debarment from federally funded programs. Additionally, we observed that the current procurement policy for the CBS Food Program does not outline a formal procedure for evaluating vendors' suspension and debarment status as required by Uniform Guidance. The results of our testing concluded that although the CBS Food Program does not currently have an established suspension and debarment policy, the sampled vendors were vetted and approved by the Commonwealth of Pennsylvania, Department of Agriculture to participate in these federal award programs. This observation highlights an impact on the CBS Food Program’s internal controls regarding compliance with suspension and debarment requirements. Questioned Costs: None Cause: The CBS Food Program’s procurement policy does not include a formal process for evaluating vendors regarding suspension and debarment, and management did not conduct the necessary suspension and debarment assessments. Effect: The lack of a formal process for evaluating vendors regarding suspension and debarment raises significant compliance concerns. Management's failure to conduct the necessary suspension and debarment assessments by reviewing the federal government's suspended or debarred list on SAM.gov indicates that there are no established procedures in place to verify that vendors are not suspended or debarred from participating in federal programs. This non-compliance could lead to questioned costs and necessitate further investigation to ensure adherence to federal regulations and proper procurement protocols. Recommendation: We recommend that management establish and implement a formal process for evaluating vendors regarding suspension and debarment. This process should include regular reviews of the federal government's suspended or debarred list on SAM.gov to ensure that vendors are not suspended or debarred from participating in federal programs. Additionally, management should ensure that all procurement policies and procedures are updated to reflect this requirement. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan.
2024-007 Federal Agencies: U.S. Department of Agriculture Federal Program Names: The Child Nutrition Cluster: National School Lunch Program Summer Food Service Program Child and Adult Care Food Program Assistance Listing Numbers: 10.555 10.559 10.558 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2023 through June 30, 2024 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria: Under 2 CFR 200.332(d), pass-through entities must monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes and in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Additionally, Child and Adult Care Program (CACFP), National School Lunch Program (NSLP) and Summer Food Service Program (SFSP) monitoring requirements established by the Pennsylvania Department of Education (PDE) require CBS Food Program to conduct meal observation reviews at each contracted center every six months, including at least two unannounced visits, and maintain documentation of such reviews. Condition: During our testing of subrecipient monitoring activities for PDE programs CACFP, NLSP, and SFSP, we selected 31 contracted centers at random. Management provided documentation for each site, including contracts, meal pattern usage records, licensure and training documentation, and both announced and unannounced meal observation reviews. However, we found that CBS Food Program did not always maintain sufficient evidence to prove required monitoring was performed under the CACFP program. For one center, management could not produce proof that meal observation reviews or the mandated two unannounced visits occurred. At another center, neither a contract nor any meal observation review records, including the two required unannounced visits, could be provided. For the NLSP and SFSP, management was unable to provide contracts for any of the seven sampled centers. Additionally, there was no evidence of training for one center, and a second center had a noncompliant monitoring visit; although corrective action was prepared, follow-up occurred only after 66 days instead of within the required 45-day window. Questioned Costs: None Cause: Management did not maintain sufficient internal controls to ensure required monitoring documentation was consistently obtained, retained, and reviewed for each contracted center. In some cases, monitoring activities may not have been performed, or they were completed but not properly documented. Effect: Failure to perform and/or document required monitoring procedures increases the risk that contracted centers may not comply with PDE CACFP, NLSP and SFSP requirements, potentially resulting in: • Noncompliance with federal monitoring requirements • Inaccurate or unsupported program reimbursements • Risk of disallowed costs or questioned costs under the PDE CACFP, NLSP, and SFSP grants • Inability to demonstrate program oversight during audits Recommendation: We recommend that management strengthen internal controls to ensure all required PDE CACFP, NLSP and SFSP subrecipient monitoring activities, including scheduled meal observations and the mandated unannounced visits—are consistently performed, documented, and retained. Management should implement a centralized tracking system to monitor review deadlines, required follow up actions, and receipt of supporting documentation from each contracted center. In addition, staff responsible for monitoring should receive periodic refresher training on PDE CACFP, NLSP and SFSP specific expectations. Finally, management should conduct periodic internal reviews to verify that monitoring documentation is complete, compliant, and appropriately maintained. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan.
2024-009 Federal Agencies: U.S. Department of Agriculture Federal Program Names: The Child Nutrition Cluster: National School Lunch Program Summer Food Service Program Child and Adult Care Food Program Assistance Listing Numbers: 10.555 10.559 10.558 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2023 through June 30, 2024 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria: The only program included in this audit with a clear definition of an excessive fund balance is the NSLP. This measure is detailed in 7 CFR 210, excerpts of which are included below: • Per 7 CFR Part 210, "The school food authority shall limit its net cash resources to an amount that does not exceed 3 months average expenditures for its nonprofit school food service or such other amount as may be approved by the State agency in accordance with §210.19(a)." Criteria (Continued): • 7 CFR Part 210 defines net cash resources as: "all monies, as determined in accordance with the State agency's established accounting system, that are available to or have accrued to a school food authority's nonprofit school food service at any given time, less cash payable. Such monies may include, but are not limited to, cash on hand, cash receivable, earnings on investments, cash on deposit and the value of stocks, bonds or other negotiable securities." • 7 CFR Part 210 definitions provide, "Nonprofit school food service account means the restricted account in which all of the revenue from all food service operations conducted by the school food authority principally for the benefit of school children is retained and used only for the operation or improvement of the nonprofit school food service. This account shall include, as appropriate, non-Federal funds used to support paid lunches as provided in §210.14(e), and proceeds from non-program foods as provided in §210.14(£)." • CACFP guidance does not clearly define what constitutes an excessive fund balance. FNS Instruction 796-2, Rev. 4, VI D Excessive Nonprofit Food Service Account Balances states: "Each State agency must determine what constitutes an excessive nonprofit food service Program balance and the corrective actions an institution must take to reduce an excess balance." PDE has communicated that it applies the NSLP excessive fund balance standard (stated above) to the CACFP. Condition: Based on Commonwealth of Pennsylvania, Office of the Budget, Bureau of Audits (Commonwealth), testing and calculations of the CBS Food Program's Net Cash Resources Available and their 3 months averages expenditures, the Commonwealth determined the Food Program's net cash resources exceeded their 3 months average expenditures as of June 30, 2024. The Commonwealth calculated both 3-month average operating expenditures and Net Cash Resources Available based on financial statement information provided by CBS Food Program. The Commonwealth's calculations of Net Cash Resources found that the Food Program exceeded their 3 months average expenditures by $2,354,119 as of June 30, 2024. The Pennsylvania Department of Education (PDE) has been communicating with CBS Food Program to develop plans for spending down their excess non-profit food program balance. Questioned Costs: None Cause: The Food Program lacked effective processes to ensure net cash resources did not exceed allowable amounts. Effect: Excess surplus funds are available to further improve or expand the Food Program's nonprofit food service for program participants. Recommendation: CBS Food Program should work with PDE to develop a plan to appropriately utilize its resources. In the future, the Food Program should monitor cash resources to ensure they do not exceed maximum thresholds required by federal regulations. Excess food program resources can be used to improve or expand the nonprofit food service for program participants. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan.
2024-010 Federal Agencies: U.S. Department of Agriculture Federal Program Names: The Child Nutrition Cluster: National School Lunch Program Summer Food Service Program Child and Adult Care Food Program Assistance Listing Numbers: 10.555 10.559 10.558 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2023 through June 30, 2024 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria: The United States Government Accountability Office's Standards for Internal Control in the Federal Government, commonly known as the "Green Book" sets standards for an effective internal control system and concepts of the Green Book can be applied to non-profit entities. The Green Book includes the following: Green Book overview section 4 - Additional Considerations includes the following related to Large versus Small Entities: A smaller entity faces greater challenges in segregating duties because of its concentration of responsibilities and authorities in the organizational structure. Management, however, can respond to this increased risk through the design of the internal control system, such as by adding additional levels of review for key operational processes, reviewing randomly selected transactions and supporting documentation, taking periodic asset counts, or checking supervisor reconciliations. (OV 4.05) Green Book Principle 10 - Design Control Activities states, in part: Segregation of duties Management divides or segregates key duties and responsibilities among different people to reduce the risk of error, misuse, or fraud. This includes separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets so that no one individual controls all key aspects of a transaction or event. (Paragraph 10.03) Green Book Principle 12 - Implement Control Activities, section 12.01 states, in part: Management should implement control activities through policies. The following attributes contribute to the design, implementation, and operating effectiveness of this principle: • Documentation of Responsibilities through Policies • Periodic Review of Control Activities Green Book Principle 4 - Demonstrate Commitment to Competence states, in part: Management defines succession and contingency plans for key roles to help the entity continue achieving its objectives. Contingency plans address the entity's need to respond to sudden personnel changes that could compromise the internal control system. (Paragraph 4.06) Condition: Based on interviews by the Commonwealth of Pennsylvania, Office of the Budget, Bureau of Audits (“Commonwealth”) with CBS Food program management, inspection of records, and on-site observations, we identified internal control deficiencies in the following areas: • For a portion of the audit period, there was a lack of segregation of duties between the cash receipt, bookkeeping, and bank reconciliation processes. The Director of Finance was responsible for all these tasks. The Director of Finance was also responsible for both processing and approving payroll and had authorization to make purchases, make vendor payments, record accounting transactions and complete bank reconciliations. • CBS Food Program performs bank reconciliations; however, they are not signed or dated by the individual performing the reconciliation and a second individual does not review or sign off on the reconciliations. Of nine reviewed account reconciliations, three were completed more than 30 days after the statement period end date. • According to CBS Food Program's former Purchasing Distribution Manager, as of June 2024, they were the only CBS Food Program's employees with detailed knowledge of developing monthly menus and creating purchase orders based on current inventory levels to meet menu requirements. Additionally, the former Purchasing Distribution Manager stated that as of June 2024 formal training on internal purchasing policies and procedures is not provided or required. • For a portion of the engagement period, CBS Food Program lacked written policies or procedures for several key business functions including: • No written Accounting Manual or Standard Operating Manual for accounting functions. • No written policy or procedure for the use of credit cards or the handling of lost or stolen credit cards. • No written policy or procedure to analyze account balances to ensure transactions have been properly recorded. • No written records retention policy. • No written procedures for handling payroll for separating employees. • No written or implemented review process for changes to the payroll system including changes to employee payrates. • For a portion of the engagement period, the Food Program did not have procedures to • Prior to July 1, 2024, CBS Food Program did not have documented procurement procedures. On July 1, 2024, CBS Food Program implemented a procurement plan. Questioned Costs: None Cause: The CBS Food Program did not develop and implement written procedures for several key financial and accounting functions. Due to the size of the organization, effective segregation of duties and contingency planning may be challenging; however, mitigating controls should be implemented to reduce risks. The sudden departure of CBS Food Program's former CEO impacted CBS's segregation of duties for a period of time as certain financial and accounting functions the former CEO was involved with fell entirely to the Director of Finance. Effect: Insufficient internal controls increase the risk of fraud, waste, and abuse in the internal control system, as well as increasing the risk for inaccurate financial reporting and non-compliance with program requirements. Recommendation: If not already addressed, CBS Food Program should develop and implement improved internal controls including: • Develop written policies, procedures and/or manuals for accounting functions. • Develop a formal internal control policy and framework that focuses on key business and operations areas including segregation of duties, transaction review and approval processes, and monitoring procedures over critical operational functions. • Improve cross training of employees including training on purchasing and accounting tasks. • CBS Food Program should develop and implement a record retention policy that complies with food program requirements for maintaining documentation of operations. The policy should ensure key records are maintained in a shared location accessible to all appropriate personnel. This ensures the CBS Food Program does not lose access to key records in the event an employee leaves the food program. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan.
2024-011 Federal Agencies: U.S. Department of Agriculture Federal Program Names: The Child Nutrition Cluster: National School Lunch Program Summer Food Service Program Child and Adult Care Food Program Assistance Listing Numbers: 10.555 10.559 10.558 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2023 through June 30, 2024 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria: The United States Government Accountability Office's Standards for Internal Control in the Federal Government, commonly known as the "Green Book," sets standards for an effective internal control system and concepts of the Green Book can be applied to non-profit entities. Green Book Principle 10 - Design Control Activities states, in part: Access restrictions to and accountability for resources and records Management limits access to resources and records to authorized individuals and assigns and maintains accountability for their custody and use. (Paragraph 10.03) Segregation of duties Management divides or segregates key duties and responsibilities among different people to reduce the risk of error, misuse, or fraud. (Paragraph 10.03) Condition: Based on the Commonwealth of Pennsylvania, Office of the Budget, Bureau of Audits (Commonwealth) review of CBS Food Programs banking policies, it was noted that the CBS Food Program did not establish appropriate controls to ensure bank account access changes and bank account closures could be promptly completed when organizational or personnel changes merited such actions. CBS Food Program management noted two instances during the engagement period in which lack of cooperation from parties with CBS Food Program bank account authority or access prevented the Food Program from closing bank accounts in an expeditious manner. This resulted in the CBS Food Program simultaneously having bank accounts open at three different banks for a portion of the audit period. As of May 2025, CBS Food Program only actively banks with one institution. Of the accounts with the other institutions, one account is closed, and the other remains open, but inactive because CBS Food Program has not initiated any account-related activity for an extended period of time. According to CBS Food Program management, they are working to close the inactive account, but closure requires assistance from Congregation Beth Solomon which has not been cooperative. The Commonwealth noted that CBS Food Program has inefficient control procedures in place over the issuance of high-value checks. Following the separation of CBS Food Program's prior CEO, the Food Program opened a new bank account in order to remove the prior CEO's access to food program funds. The former CEO was not cooperative in removing his access to the bank account the Food Program used at the time of his separation, so CBS Food Program determined moving the Food Program's funds to a new bank was in the best interest of the organization. To move the Food Program's funds from the old bank to the new bank, CBS Food Program's Director of Finance wrote two checks for $1.5 million dollars each. While CBS Food Program's Director of Finance obtained approval from the board prior to preparing and depositing the checks in the new bank account, a secondary signature was not obtained as CBS Food Program policy did not require a second signature for any check regardless of amount. Questioned Costs: None Cause: The CBS Food Program did not establish appropriate controls to ensure bank account access changes and bank account closures could be promptly completed when organizational or personnel changes merited such actions. Lack of cooperation from CBS Food Program's prior CEO and Congregation Beth Solomon also contributed to difficulty in modifying bank account authorization. CBS Food Program did not establish a threshold requiring dual signatures for checks. Effect: An inability to expeditiously modify bank account access and authorization increases potential for inappropriate use of program funds. Lack of dual signatures on high-value checks increases the likelihood that an individual could write improper checks of significant value. Recommendation: CBS Food Program should assign bank authorization and access roles to appropriate CBS representatives to ensure access is appropriately limited, but that changes to account authorization can be completed timely when organizational or personnel changes merit such modifications. CBS Food Program should establish, document, and adhere to, a policy requiring documented prior approval and dual signatures on checks exceeding a predetermined threshold set by management and/or the board of directors. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan.
2024-012 Federal Agencies: U.S. Department of Agriculture Federal Program Names: The Child Nutrition Cluster: National School Lunch Program Summer Food Service Program Child and Adult Care Food Program Assistance Listing Numbers: 10.555 10.559 10.558 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2023 through June 30, 2024 Type of Finding: • Material Weakness in Internal Control over Compliance Criteria: The United States Government Accountability Office's Standards for Internal Control in the Federal Government, commonly known as the "Green Book," sets standards for an effective internal control system and concepts of the Green Book can be applied to non-profit entities. Green Book Principle 11 - Design Activities for the Information System, section 11.01 states, in part: Management should design the entity's information system and related control activities to achieve objectives and respond to risks. The following attributes contribute to the design, implementation, and operating effectiveness of this principle: • Design of the Entity's Information System • Design of Appropriate Types of Control Activities • Design of Information Technology Infrastructure • Design of Security Management • Design of Information Technology Acquisition, Development, and Maintenance Condition: Based on the Commonwealth of Pennsylvania, Office of the Budget, Bureau of Audits (Commonwealth) review of CBS Food Program's financial accounting system, it was noted that the Food Program utilizes QuickBooks software for their accounting system. Based on inquiry with CBS Food Program management, we determined internal controls connected with their QuickBooks accounting software were insufficient in the following areas: • User Access Management: Formal written policies or procedures have not been developed and implemented related to access authorization, access monitoring, and removal of system access. Additionally, certain functions are not properly segregated as users have access to perform both input and authorization of transactions. • Input Management: Formal written policies or procedures to ensure information input into QuickBooks is appropriate and accurate have not been developed and implemented. • Change Control Management: A formal written change management policy for QuickBooks Accounting System has not been developed and implemented including requirements that system security updates are implemented timely. • Backup and Recovery: A formal written policy for regular backup and recovery testing has not been developed and implemented. Questioned Costs: None Cause: The CBS Food Program's lack of policies and procedures over QuickBooks may be due to inadequate resources, insufficient information technology governance, and/or a lack of awareness of information technology control requirements. Additionally, the CBS Food Program management may not place adequate focus on enforcing information technology control measures as part of the overall control environment. Effect: The lack of established and documented controls over QuickBooks increases the risk of unauthorized access, system disruption, and data loss. Additionally, without a written disaster recovery plan the Food Program is exposed to increased risks of prolonged downtime in the event of a disaster or system failure. These weaknesses may compromise the confidentiality, integrity, and availability of critical data. Recommendation: We recommend that CBS Food Program develop and implement comprehensive written internal control policies and procedures connected with their QuickBooks Accounting System. This should include: • Development and utilization of an Accounting Manual which includes an outline of CBS Food Program's accounting rules, procedures, and guidelines. • Access control policies and procedures to ensure that user access to QuickBooks is appropriate, regularly reviewed and promptly revoked upon termination or when otherwise merited. • A formal written change management policy for QuickBooks should be developed and implemented including requirements that systems security updates are implemented timely. • A disaster recovery plan and procedures to perform periodic testing to ensure that plans are functional and mitigate the risk of extended downtime. This process should also include regular review of backup records to ensure they are appropriately created and maintained. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan.