Audit 414150

Finding: Item 2025-001 – Subrecipient Risk Assessments Not Performed or Documented Significant Deficiency Federal Program – Regional Technology and Innovation Hubs Assistance Listing Number – 11.039 Federal Agency – Economic Development Administration Pass-through Grantor's Numbers – N/A Federal Award Year – December 31, 2025 Criteria: 2 CFR 200.332(c) requires that pass-through entities evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. This evaluation should be documented and used to support the nature, timing, and extent of subrecipient monitoring procedures performed. Condition/context: The Foundation had not established or documented an ongoing risk assessment process for evaluating the fraud risk and risk of noncompliance for each subrecipient, as required by Uniform Guidance. Although the Foundation performed various subrecipient monitoring activities, it did not document the basis for determining the nature, timing, and extent of those procedures. Cause: The Foundation had not established formal written procedures requiring the completion and documentation of subrecipient risk assessments. Management relied on existing monitoring activities, including the review of subrecipient reports, expenditure documentation, ongoing communication with subrecipients, and knowledge of subrecipient experience with federal awards; however, a formal process had not been implemented to evaluate and document subrecipient risk in accordance with Uniform Guidance requirements. Effect: The lack of documented subrecipient risk assessments could result in monitoring procedures that are not appropriately designed to address each subrecipient's fraud risk and risk of noncompliance with federal award requirements. This could lead to instances of noncompliance, questioned costs, or requests for corrective action by federal agencies. Questioned cost: Not applicable. Repeat finding: No. Recommendation: The Foundation should establish, document, and maintain effective internal control procedures over subrecipient monitoring to provide reasonable assurance that subrecipients are managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These procedures should include a documented evaluation of subrecipient risk, as required by 2 CFR 200.332, to support the appropriate level of monitoring performed for each subrecipient. View of responsible officials: Management's response is reported in "Corrective Action Plan" at the end of this report.