Audit 389127

Finding 2025-001 Subrecipient Monitoring (Significant Deficiency) Information on the Federal Programs: Fish and Wildlife Cluster Criteria or Specific Requirement: Under 2 CFR 200.332, pass-through entities are required to evaluate each subrecipient’s risk of noncompliance to determine the appropriate monitoring, monitor subrecipient activities as necessary to ensure compliance with Federal requirements, and verify whether subrecipients that meet the Federal expenditure threshold have obtained a Single Audit. These responsibilities include performing and documenting a subrecipient risk assessment, conducting monitoring activities based on the assessed risk, and obtaining, reviewing, and following up on subrecipient Single Audit reports when applicable. Condition: The Organization does not maintain written policies or procedures that address required subrecipient monitoring activities. The Organization does not perform or document a risk assessment of subrecipients to evaluate their risk of material noncompliance and does not have monitoring procedures that correspond to an assessed level of risk. Additionally, the Organization does not have a policy or consistent practice for determining whether subrecipients are subject to Uniform Guidance Subpart F Single Audit requirements, nor does it obtain or review Single Audit reports from subrecipients that meet the required threshold. Cause: This condition exists because the Organization has not established formal internal controls or written procedures to ensure compliance with all Federal requirements related to subrecipient monitoring. Effect or Potential Effect: As a result, the Organization is not fully compliant with the requirements of 2 CFR 200.332, and there is an increased risk that subrecipient noncompliance may occur and remain undetected. The absence of appropriate risk assessment and monitoring procedures increases the likelihood that programmatic or financial issues at the subrecipient level could go unidentified. Failure to obtain and review required Single Audit reports also increases the risk that audit findings, questioned costs, or other compliance concerns may not be addressed by the Organization in a timely manner. Although no questioned costs were identified during our audit, the control deficiencies described above increase the risk of future questioned costs. Questioned Costs: N/A. Context: This finding was noted during our review of the Organization’s subrecipient monitoring practices and reflects a systemic lack of documented policies and procedures governing the required elements of risk assessment, monitoring, and Single Audit verification. Identification as a Repeat Finding, if Applicable: No. Recommendation: We recommend that the Organization develop and implement comprehensive written subrecipient monitoring policies and procedures that align with 2 CFR 200.332. These procedures should include conducting and documenting a risk assessment for each subrecipient, establishing monitoring activities that are responsive to the level of assessed risk, and implementing a process to determine whether subrecipients are required to obtain a Single Audit and to obtain, review, and follow up on those audit reports as necessary. Establishing these controls will help ensure compliance with Federal requirements and reduce the risk of undetected noncompliance at the subrecipient level.