Audit 395559

Reference Number: 2025-002 Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds Federal Assistance Listing Number: 21.027 Federal Agency: U.S. Department of Treasury Pass-Through Entity: N/A Federal Award Number and Year: Fiscal Year 2024-25 Name of Department with Finding: Department of Consumer and Business Affairs Name of Departments with No Findings: Chief Executive Office Aging and Disabilities Executive Office of the Board of Supervisors Department of Public Health Department of Economic Opportunity Internal Services Justice Care and Opportunities Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance; Instance of Noncompliance Criteria In accordance with Title 2 U.S. Code of Federal Regulations (CFR) § 200.332(c)(e)(f), all pass-through entities must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Condition During our audit of the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program, we selected twenty one (21) subrecipients with active contracts with the County during FY 2024-25. We noted that the Department of Consumer and Business Affairs (DCBA) did not perform subrecipient monitoring for four (4) contracts administered by the department, of which one (1) contract did not have a risk assessment performed during FY 2024-25. In addition, we selected two (2) subrecipients with total expenditures of $19,217,030 that were subjected to subrecipient monitoring compliance requirements; however, it was determined that the selected subrecipients were vendors and inadvertently included in the subrecipient population. In the SEFA, the passed through to subrecipients column for this grant was reduced by $19,217,030 to reflect this correction. This is a repeat finding of 2024-002 as it relates to the subrecipient monitoring portion of the Condition. Cause Due to limited resources, the department needed more time to complete risk assessment, monitor the CSLFRF subrecipients and document the reviews in accordance with subrecipient monitoring requirements. Effect Failure to document risk assessment and monitoring results is noncompliance with the subrecipient monitoring requirements 2 CFR § 200.332 (c)(e)(f). Questioned Costs Questioned costs were not determinable. Context Of the twenty one (21) subrecipients selected for testing, which totaled $192,086,158, from a population of ninety-seven (97) subrecipients with expenditures totaling $282,469,393, the department did not perform an annual risk assessment for one (1) subrecipient and they did not have documentary evidence supporting the monitoring of four (4) subrecipients with expenditures totaling $5,917,341. However, the department retained copies of the subrecipients’ single audit reports. The misclassification of vendors was corrected by removing them from the subrecipient expenditures, which decreased subrecipient expenditures from $301,686,423 to $282,469,393. DCBA had 7 subrecipients with total expenditures of $99,128,273 out of the total of 97 subrecipients with total expenditures of $282,469,393. The sample was not a statistically valid sample. Recommendation We recommend the County perform risk assessments and monitor the activities of its subrecipients as necessary to ensure that subawards are used for authorized purposes and maintain appropriate records for monitoring subrecipients in accordance with subrecipient monitoring requirements set forth in 2 CFR § 200.332 (c)(e)(f).

Reference Number: 2025-003 Federal Program Title: Immunization Cooperative Agreements Federal Assistance Listing Number: 93.268 Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: California Department of Public Health (CDPH) Federal Award Number and Year: 22-11039 July 1, 2022 – June 30, 2027 Name of Department: Department of Public Health, Immunization Program Category of Finding: Reporting and Special Tests and Provisions Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria In accordance with the Scope of Work (SOW) of the grant agreement and the related statutes under the California Health & Safety Code sections: • 120130 requires the Local Health Officer to properly report to CDPH those diseases listed as reportable, which include vaccine-preventable diseases. • 120175 requires the Local Health Officer to take measures as may be necessary to prevent the spread or occurrence of additional cases of reportable diseases (which includes reportable vaccine-preventable diseases). • 120350 requires Local Health Officers to organize and maintain a program to make available the immunizations required for admittance to childcare facilities and schools. The County of Los Angeles Department of Public Health (DPH) is responsible for monitoring each program component: 1) Vaccine Accountability and Management; 2) Access to and Utilization of Quality Immunization Services; 3) California Immunization Registry (CAIR); 4) Perinatal Hepatitis B Prevention; 5) Education, Information, Training, and Partnerships; 6) Prevention, Surveillance and Control of Vaccine Preventable Disease (VPD); 7) Childcare and School Immunization Entry Requirements; 8) Influenza; and 9) COVID-19 Vaccination. Under each of these component areas, there are objectives and required activities to be performed to meet the objectives. On a semi-annual basis, the Los Angeles County Vaccine Preventable Disease Control Program (VPDCP) will report to CDPH on the progress for the pertinent objectives and activities, as delineated in the grant SOW. Condition During our audit of DPH Immunization Cooperative Agreement program’s Access to and Utilization of Quality Immunization Services component, we noted that VPDCP was unable to provide the supporting log of Medi-Cal members’ access to immunization problems resolved at the local level or reported to CDPH. Cause The log documenting Medi-Cal members’ access to immunization problems could not be located. VPDCP management indicated that, due to staff turnover, the file may have been saved on an individual employee’s local drive rather than in a shared directory accessible to the program. Effect The absence of required documentation prevents validation of the reported progress and undermines assurance that the objective was achieved as stated. Questioned Cost Questioned costs were not identified. Context In the Biannual Progress Report for January 1, 2025, to June 30, 2025, VPDCP reported that Component Area 2, Goal 2.1b had been met. The performance measure for this activity requires VPDCP to maintain a log of access problems resolved at the local level or reported to CDPH. VPDCP was unable to provide this log, preventing confirmation that the activity was completed as reported. Recommendation VPDCP should require all required program documentation be stored in a centralized shared location and implement oversight procedures, including transition checklists and periodic reviews, to ensure documentation is consistently maintained and accessible. These actions will help ensure that required evidence is consistently retained and available to support reported progress to the CDPH.