Finding 2020-005 – Lack of Internal Controls and Noncompliance Over Major Federal Program – Disaster Grants – Public Assistance (Presidentially Declared Disasters) PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management FEDERAL AGENCY: U.S. Department of Homeland Security ASSISTANCE LISTING: 97.036 FEDERAL PROGRAM NAME: Disaster Grants – Public Assistance (Presidentially Declared Disasters) FEDERAL AWARD YEAR: 2019 FEDERAL AWARD NUMBER: DR-4315 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Costs Principles; Period of Performance; Reporting; and Special Tests and Provisions QUESTIONED COSTS: $243,489 Condition: Upon inquiry of county personnel, the following Project Worksheets (PW) for DR-4315 and any supporting documentation of expenditures could not be located for District 1 totaling $243,489: • PW 178 (site 1) in the amount of $27,566. • PW 185 (all sites) in the amount of $48,785. • PW 192 (all sites) in the amount of $76,276. • PW 193 (all sites) in the amount of $90,862. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal expenditures are made in accordance with federal grant requirements and to ensure that the supporting documentation is maintained and readily available. Effect of Condition: These conditions resulted in noncompliance with grant requirements and could result in loss of federal funds. Recommendation: OSAI recommends the County design and implement a system of internal controls to ensure compliance with grant requirements and to ensure that documentation of federal expenditures is maintained and readily available. Management Response: District 1 County Commissioner: Auditors initially indicated that documentation was required for FEMA Event 4315 only. Subsequently, the scope of the request was expanded to include “all events” without a clear written explanation or formal notification of the expanded scope. Following an on-site visit to the county barn for a tabletop discussion, the auditor sent an email dated May 11, 2023, identifying specific projects for which documentation was reportedly still needed. The projects later cited in Audit Finding 2020-005 were not included in that list. On June 12, 2023, the auditor emailed stating: “I believe I have documents for every project except 4575.203.454750 and 4575.203.454831 (Disaster. Project Worksheet.Site).” The requested documentation was provided promptly, and the auditor acknowledged receipt. The auditor subsequently sent several clarifying questions and, in a final email dated June 20, 2023, stated that he would consult with his team and follow up as needed. No further communication was received from the auditor or any member of the auditor’s office requesting additional documentation. Nearly three years have elapsed without follow-up. The County does have documentation for all projects listed in the audit finding and these records were provided to auditors during their on-site visits to the county barn. Auditor Response: Supporting documentation could not be provided to the auditors when requested and has not been provided to date. Uniform Guidance and GAO Standards require internal controls to be designed and implemented, as well as maintaining supporting documentation for all federal grant expenditures. District 2 County Commissioner: I am aware of the audit findings involving FEMA Disaster 4315. I apologize for the delayed response letter. On behalf of Dewey County District 2, we want to assure you we are here to help and assist you with anything you or your office may need from myself, or from any District 2 employee. Criteria: The GAO Standards – Section 1 – Fundamental Concepts of Internal Control – OV1.01 states in part: Definition of Internal Controls Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR § 200.318(a), General procurement standards, reads as follows: The recipient or subrecipient must maintain and use documented procedures for procurement transactions under a Federal award or subaward, including for acquisition of property or services. These documented procurement procedures must be consistent with State, local, and tribal laws and regulations and the standards identified in 200.317 through 200.327. 2 CFR § 200.84 Questioned Cost reads as follows: Questioned cost means a cost that is questioned by the auditor because of an audit finding: (a) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for fund used to match Federal funds; (b) Where the costs, at the time of the audit, are not supported by adequate documentation; or (c) Where the costs incurred appear unreasonable and do not reflect the actions a prudent person would take in the circumstances. Further, GAO Standards – Section 2 – Objectives of an Entity – OV2.23 states in part: Compliance Objectives Management conducts activities in accordance with applicable laws and regulations. As part of specifying compliance objectives, the entity determines which laws and regulations apply to the entity. Management is expected to set objectives that incorporate these requirements. […]
Finding 2020-006 – Lack of County-Wide Controls Over Major Federal Programs – Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Repeat Finding – 2017-013, 2018-004) PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management FEDERAL AGENCY: U.S. Department of Homeland Security ASSISTANCE LISTING: 97.036 FEDERAL PROGRAM NAME: Disaster Grants – Public Assistance (Presidentially Declared Disasters) FEDERAL AWARD NUMBER: DR-4438 and DR-4315 FEDERAL AWARD YEAR: 2019 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance; Reporting; Special Tests and Provisions QUESTIONED COSTS: $-0- Condition: County-wide controls regarding Control Environment, Risk Assessment, Information and Communication, and Monitoring have not been designed. Cause of Condition: Policies and procedures have not been designed and implemented to ensure the County complies with grant requirements. Effect of Condition: This condition could result in noncompliance with grant requirements. Recommendation: OSAI recommends that the County design and implement a system of internal controls to ensure compliance with grant requirements. Management Response: Chairman of the Board of County Commissioners: The County will include all federal grant discussion in our Officers’ meetings so that all Elected Officials are aware. We will discuss the Control Environment, Risk Assessment, Information and Communication, and Monitoring for all federal grants. Criteria: The GAO Standards – Section 1 – Fundamental Concepts of Internal Control – OV1.01 states in part: Definition of Internal Control Internal control is a process effected by an entity’s oversight body, management, and other personnel that provides reasonable assurance that the objectives of an entity will be achieved. Additionally, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.04 states in part: Components, Principles, and Attributes Control Environment – The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives. Risk Assessment – Assesses the risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses. Information and Communication – The quality information management and personnel communicate and use to support the internal control system. Monitoring – Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews.
Finding 2020-007 – Lack of Internal Controls Over Major Federal Programs – Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Repeat Finding – 2017-014, 2018-005) PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management FEDERAL AGENCY: U.S. Department of Homeland Security ASSISTANCE LISTING: 97.036 FEDERAL PROGRAM NAME: Disaster Grants – Public Assistance (Presidentially Declared Disasters) FEDERAL AWARD NUMBER: DR-4438 and DR-4315 FEDERAL AWARD YEAR: 2019 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance; Reporting; Special Tests and Provisions QUESTIONED COSTS: $-0- Condition: During the process of documenting the County’s internal controls regarding federal disbursements, we noted that the County has not established procedures to ensure compliance with the following requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance; Reporting; Special Tests and Provisions. Cause of Condition: Policies and procedures have not been designed and implemented to ensure federal expenditures are made in accordance with federal compliance requirements. Effect of Condition: This condition resulted in noncompliance with grant requirements and could lead to a loss of federal funds to the County. Recommendation: OSAI recommends the County gain an understanding of requirements for this program and implement internal control procedures to ensure compliance with grant requirements. Management Response: Chairman of the Board of County Commissioners: The County will include discussion of all required compliance requirements for each federal program presented in our Officers’ meetings. District 1 County Commissioner: There are numerous external controls associated with federal funding, including oversight from both state and federal agencies. Internally, we have encountered resistance from certain county officials who are less familiar with the scope and structure of large federal projects. This included a former official who repeatedly asserted that “$400,000.00 is missing,” despite being shown conclusively that no funds were missing. That official resigned shortly thereafter. Incidents of this nature have made it more difficult to engage in productive discussions regarding internal controls. Nonetheless, I remain willing to meet openly and discuss internal controls in a transparent and constructive manner. Auditor Response: Uniform Guidance and GAO Standards require internal controls to be designed and implemented for all federal grant expenditures. Criteria: 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Further, GAO Standards – Section 2 – Establishing an Effective Internal Control System – OV2.23 states in part: Objectives of an Entity – Compliance Objectives Management conducts activities in accordance with applicable laws and regulations. As part of specifying compliance objectives, the entity determines which laws and regulations apply to the entity. Management is expected to set objectives that incorporate these requirements.
Finding 2020-008 – Lack of Internal Controls Over the SEFA and Noncompliance with Compliance Requirements Over Major Federal Programs – FEMA (Repeat Finding – 2018-006) PASS-THROUGH GRANTOR: Oklahoma Department of Emergency Management FEDERAL AGENCY: U.S. Department of Homeland Security ASSISTANCE LISTING: 97.036 FEDERAL PROGRAM NAME: Disaster Grants – Public Assistance (Presidentially Declared Disasters) FEDERAL AWARD NUMBER: DR-4438 and DR-4315 FEDERAL AWARD YEAR: 2019 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance; Reporting; Special Tests and Provisions QUESTIONED COSTS: $1,040,042 Condition: Upon inquiry of District 1 staff and review of documentation and compliance procedures for ALN 97.036, the following items were noted: • Due to scope limitations placed on the audit, auditors were unable to access records and the ability to communicate with District 1 employees was restricted. • Documents reported to the auditors could not be reconciled to the amounts reported on the Schedule of Expenditures of Federal Awards (SEFA). • District 1 did not print or certify any expense reports; therefore, any supporting documentation was not reviewed when reporting federal expenditures to the County Clerk. • District 1 was unable to meet the deadlines set by themselves, as it took nine months for the County to submit limited documentation to the auditors for federal projects. • Federal expenditures could not be tested due to inadequate implementation of policies and procedures regarding the reporting and retention of federal expense documentation. Cause of Condition: Policies and procedures have not been designed and implemented to ensure accurate reporting on the County’s SEFA, and to ensure federal expenditures are made in accordance with federal compliance requirements. Effect of Condition: These conditions resulted in noncompliance with grant requirements and could result in loss of federal funds to the County. Recommendation: OSAI recommends the County gain an understanding of the compliance requirements for federal programs and implement internal control procedures to ensure compliance with all requirements. Further, we recommend all documentation be properly maintained for inspection and ensure accurate reporting on the County’s SEFA. Management Response: Chairman of the Board of County Commissioners: The County will make sure that all federal documentation is maintained by each district for inspection and will ensure it is accurately reported on the SEFA. District 1 County Commissioner: All work associated with the projects referenced in Audit Finding 2020-005 was completed in accordance with FEMA requirements. The work was fully documented, and final results were physically inspected on site by Oklahoma Emergency Management (OEM) personnel. Both OEM and FEMA reviewed and accepted the work performed and the supporting documentation, as evidenced by the county’s reimbursement for the completed projects. FEMA reimbursement would not have occurred had the work or documentation been deficient. Auditors initially indicated that documentation was required for FEMA Event 4315 only. Subsequently, the scope of the request was expanded to include “all events” without a clear written explanation or formal notification of the expanded scope. Following an on-site visit to the county barn for a tabletop discussion, the auditor sent an email dated May 11, 2023, identifying specific projects for which documentation was reportedly still needed. The projects later cited in Audit Finding 2020-005 were not included in that list. On June 12, 2023, the auditor emailed stating: “I believe I have documents for every project except 4575.203.454750 and 4575.203.454831 (Disaster. Project Worksheet.Site).” The requested documentation was provided promptly, and the auditor acknowledged receipt. He subsequently sent several clarifying questions and, in a final email dated June 20, 2023, stated that he would consult with his team and follow up as needed. No further communication was received from the auditor or any member of the auditor’s office requesting additional documentation. Nearly three years have elapsed without follow-up. The County does have documentation for all projects listed in the audit finding, and these records were provided to auditors during their on-site visits to the county barn. Auditor Response: District 1 did not comply with all requirements of the federal grant including, but not limited to, providing documentation for audit purposes and preparing accurate and reconciled reports. The required documentation to support the FEMA expenditures were not provided to the auditors. Physical inspections by FEMA or OEM do not constitute an audit under Uniform Guidance. An audit includes examining all supporting documentation to ensure the County complied with all the compliance requirements required by Uniform Guidance. Maintaining adequate documentation to support federal grant expenditures is critical for the County to comply with federal compliance requirements. Criteria: 2 CFR § 200.303(a) Internal Controls reads as follows: The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 CFR § 200.318 (a), General procurement standards, reads as follows: The recipient or subrecipient must maintain and use documented procedures for procurement transactions under a Federal award or subaward, including for acquisition of property or services. These documented procurement procedures must be consistent with State, local, and tribal laws and regulations and the standards identified in 200.317 through 200.327. Title 2 CFR § 200.84 Questioned Cost reads as follows: Questioned cost means a cost that is questioned by the auditor because of an audit finding: (a) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for fund used to match Federal funds; (b) Where the costs, at the time of the audit, are not supported by adequate documentation; or (c) Where the costs incurred appear unreasonable and do not reflect the actions a prudent person would take in the circumstances. Further, GAO Standards – Section 2 – Objectives of an Entity – OV2.23 states in part: Compliance Objectives Management conducts activities in accordance with applicable laws and regulations. As part of specifying compliance objectives, the entity determines which laws and regulations apply to the entity. Management is expected to set objectives that incorporate these requirements. [….] The limitations of the auditor are described in the American Institute of Certified Public Accountants Clarified Statements on Auditing Standards AU-C § 210, which states, in part: “The concept of an independent audit requires that the auditor's role does not involve assuming management's responsibility for the preparation and fair presentation of the financial statements or assuming responsibility for the entity's related internal control and that the auditor has a reasonable expectation of obtaining the information necessary for the audit insofar as management is able to provide or procure it. Accordingly, the premise is fundamental to the conduct of an independent audit.”