Audit 396036

Finding 2025-001: Internal control deficiency over activities allowed or unallowed and allowable costs/cost principles related to the review of payroll expenditures. Identification of the federal program: Assistance Listing Number 97.036: • COVID-19 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) • U.S. Department of Homeland Security • Federal award identification number – Project number 743873 – Management Costs • Federal award year – January 20, 2020 (Incident Start Date), May 11, 2023 (Incident End Date), and May 11, 2025 (Activity Completion Date) • Pass-through entity – California Governor’s Office of Emergency Services • Pass-through award identification number – FEMA-4482-DR-CA, Cal OES ID: 073-90741 Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.303 – Internal controls. The recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing over payroll expenditures, we observed management did not have effective internal controls in place to ensure certain payroll expenditures were reviewed. There were 8 out of 40 selections where the payroll expenditures were not reviewed. Cause: Management did not have effective internal controls in place over the compliance requirement as stated in the criteria or specific requirement section above. Effect or potential effect: Payroll expenditures were not supported by effective internal controls. Without sufficient internal controls, compliance matters could occur in the future. Questioned costs: None. Context: During our internal control testing over activities allowed or unallowed and allowable costs/cost principles, we obtained a listing of 543 payroll expenditures and selected a sample of 40 to test for the review of the expenditure. The total value of the 40 payroll expenditures selected was $12,518 out of the total payroll expenditures of $165,720. There were 8 ($3,123) out of 40 ($12,518) selections where the payroll expenditures were not reviewed. The 8 selections were for allowable activities under this program and therefore, no noncompliance was observed in our testing. The sampling was a statistically valid sample. Identification as a repeat finding, if applicable: No. Recommendation: Management should develop and implement effective internal controls to ensure payroll expenditures are reviewed. Views of responsible officials: Additional internal controls to ensure payroll expenditures are reviewed were implemented in late fiscal year 2022 by adopting a new approach to ensure compliant timekeeping. The new approach includes the following steps: revised the timekeeping policy to clarify employee and manager responsibilities, modified “failure to comply” provisions, deployed educational programs for both management and staff, reviewed/improved Kronos and UKG Pro Time and Attendance system automated notifications, and training resources have been available to management and staff via our Scripps intranet site. Leadership monitors policy compliance by individual employee and managers via systemwide reporting on a biweekly basis.