Audit 407625

Finding 2025-001 – Internal control deficiency over Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance, Reporting, and Special Tests and Provisions. Identification of the federal program: Assistance Listing Number 97.036: • COVID-19 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) • U.S. Department of Homeland Security • Federal award identification number – Project number 159449 – Force Account and Contract Labor • Federal award year – January 20, 2020 (Incident Start Date), May 11, 2023 (Incident End Date), and July 1, 2022 (Activity Completion Date) • Pass-through entity – California Governor’s Office of Emergency Services • Pass-through award identification number – FEMA-4482-DR-CA, Cal OES ID: 083-90302 Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A, Chapter II, Part 200, Subpart D, 200.303 – Internal controls. The recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We observed management did not design effective internal controls to ensure documentation was retained to evidence the operating effectiveness of the internal controls. Cause: Management did not design effective internal controls over the compliance requirements as stated in the criteria or specific requirements section above. Effect or potential effect: Management did not design effective internal controls to retain documentation to evidence the operating effectiveness of the internal controls over the project and related expenses submitted to FEMA for reimbursement. Without sufficient internal controls, compliance matters could occur in the future. Questioned costs: None. Context: We did not test internal controls given management did not design effective internal controls to retain documentation to evidence the operating effectiveness of the internal controls over the project and related expenses submitted to FEMA for reimbursement. Identification as a repeat finding, if applicable: Yes – Finding 2023–001. Recommendation: Management should development and implement effective internal controls to ensure documentation is retained to evidence the operating effectiveness of the internal controls over the project and related expenses submitted to FEMA for reimbursement. Views of responsible officials: Management will develop and implement additional internal controls to ensure that adequate documentation is retained to evidence the design and operating effectiveness of controls over FEMA-related expenditures. These internal controls will be designed to ensure that expenses included in FEMA grant applications are complete, accurate, and allowable in accordance with program requirements. Specifically, management will implement a reconciliation process comparing detailed application expenses to the corresponding final paid invoices or payroll expenditures. As part of this process, each expense will be reviewed and annotated to confirm its allowability under FEMA guidelines. The reconciliation will be subject to review and approval by the Cottage Health Vice President of Finance prior to submission of the FEMA application. Evidence of this review and approval will be formally documented and retained.