Finding 2025-001 Type of Finding: Material weakness in internal control over compliance and material noncompliance Compliance requirement: Subrecipient monitoring Criteria: In accordance with the Uniform Guidance, a pass-through entity is required to clearly identify to subrecipients the award as a federal subaward and provide the information required by the Uniform Guidance. A pass-through entity is required to evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. A pass-through entity is also required to monitor the activities of the subrecipient based on risk assessment and required monitoring outlined in the Uniform Guidance. Condition: Willamette Health Council did not comply with the subrecipient monitoring requirements applicable to the Federal program. Specifically, Willamette Health Council did not clearly identify the pertinent federal award information and terms and conditions to the subrecipients. Willamette Health Council also did not adequately perform, and did not document performance of, risk assessments for the subrecipients to determine the nature, timing and extent of monitoring procedures. Willamette Health Council performed some monitoring of subrecipients including periodic meetings, review of expenditures, and review of progress reports; however, Willamette Health Council failed to inquire of subrecipients regarding audit requirements and/or request copies of any audits completed for subrecipients. Cause: Willamette Health Council did not identify all required elements of compliance with respect to subrecipient monitoring and did not design and implement adequate internal controls over compliance ensure compliance with the subrecipient award identification, risk assessment and monitoring requirements as outlined in the Uniform Guidance. Effect / Potential Effect: Without properly designed and implemented subrecipient monitoring controls, there is an increased risk that subrecipients may not comply with federal statutes, regulations, and the terms and conditions of subawards, and that noncompliance may not be prevented, detected, or corrected on a timely basis. The deficiencies represent a material weakness in internal control over compliance and resulted in the auditor’s qualified opinion on compliance with respect to subrecipient monitoring. Questioned Costs: None. Context/Perspective: The deficiencies and noncompliance was pervasive. Repeat Finding: Not applicable. There was no prior year audit. Recommendation: We recommend that Willamette Health Council implement and document subrecipient monitoring policies and procedures that, at a minimum: - Require subaward agreements to clearly identify the award as a subaward and include required federal award identification information and applicable requirements and terms. - Require documented subrecipient risk assessments to be performed timely and updated as appropriate to determine risk-based monitoring. - Establish minimum monitoring procedures (for example, review of financial and performance reports, follow-up on significant developments, and documented periodic monitoring) commensurate with assessed risk. - Require verification of subrecipient audit requirements, including obtaining and reviewing applicable audit reports (or other required audit documentation), and documenting follow-up on subaward-related audit findings as applicable. View of Responsible Officials: Management agrees with the finding. See Corrective Action Plan.
Finding 2025-002 Type of Finding: Material weakness in internal control over compliance and instance of immaterial noncompliance Compliance requirement: Procurement and suspension and debarment Criteria: Uniform Guidance procurement standards require nonfederal entities to use documented procurement procedures and maintain procurement policies and procedures that conform to applicable federal requirements for procurement transactions under a federal award. Condition: Willamette Health Council did not have written procurement policies and procedures that conform to, or contain all required elements of, the Uniform Guidance procurement standards. Although Willamette Health Council did not have compliant written procurement policies, there were no procurements tested (and none identified by management) with expenditures exceeding the applicable micro-purchase threshold during the audit period. Cause: Willamette Health Council had not established and implemented formal, written procurement policies and procedures aligned with Uniform Guidance requirements, including periodic review and updates to ensure continued compliance. Effect / Potential Effect: While no procurements exceeding the micro-purchase threshold were identified during the audit period (and therefore the instance of noncompliance is considered immaterial), the absence of compliant written procurement policies represents a deficiency in the design of internal control over compliance. Without properly designed procurement policies and procedures, there is an increased risk that future procurement transactions may not be conducted in accordance with the Uniform Guidance and that noncompliance may not be prevented, detected, or corrected on a timely basis. Accordingly, this condition is considered a material weakness in internal control over compliance. Questioned Costs: None. Context/Perspective: Per review of Willamette Health Council expenditure records, procurement transactions during the period totaled $18,683; and all of which were under $10,000 thus, the micropurchase threshold applied. Repeat Finding: Not applicable. There was no prior year audit. Recommendation: We recommend that Willamette Health Council develop, approve, and implement written procurement policies and procedures that conform to the Uniform Guidance procurement standards outlined in 2 CFR §200.318 through §200.327. View of Responsible Officials: Management agrees with the finding. See Corrective Action Plan.
Finding 2025-003 Type of Finding: Significant deficiency in internal control over compliance Compliance requirement: Procurement and suspension and debarment Criteria: The Uniform Guidance requires pass-through entities to verify that subrecipients are not excluded or disqualified in accordance with 2 CFR § 180.300 (e.g., suspension, debarment, or other exclusion), including verification through SAM.gov or other methods permitted under the federal regulations. Condition: Willamette Health Council made subrecipient awards during the audit period; however, Willamette Health Council did not have properly designed and implemented internal controls over compliance to verify that subrecipients were not suspended, debarred, or otherwise excluded from receiving federal funds (for example, by checking SAM.gov) prior to issuing the subawards. All such subrecipient awards should have been checked against SAM.gov for suspension and debarment/exclusion status. Willamette Health Council relied on the awarding agency to assist with approving subrecipients; however, Willamette Health Council did not document an independent verification or other control to confirm that subrecipients were not excluded or disqualified. Cause of Condition: Willamette Health Council did not establish written policies and procedures assigning responsibility for suspension and debarment verification and documentation (including when and how to perform SAM.gov verification and how to retain evidence of verification) for subawards. Effect / Potential Effect: Without controls to verify subrecipient eligibility with respect to suspension and debarment, Willamette Health Council increases the risk of making subawards to ineligible subrecipients and noncompliance with applicable federal requirements may not be prevented or detected on a timely basis. No subrecipients tested were identified as suspended, debarred, or otherwise excluded; therefore, no questioned costs were identified. Questioned Costs: None. Context/Perspective: There were five subrecipients subject to this requirement during the audit period. The subaward files/documentation did not contain evidence of SAM.gov verification; however, auditor performed independent verification on SAM.gov noting the subrecipients were not on the exclusions listing. Repeat Finding: Not applicable. There was no prior year audit. Recommendation: We recommend that Willamette Health Council implement and document policies and procedures to verify that subrecipients are not excluded or disqualified prior to issuing subawards (and periodically thereafter, if deemed appropriate). View of Responsible Officials: Management agrees with the finding. See Corrective Action Plan.