Federal Agencies: U.S. Department of Agriculture Federal Program Names: Child and Adult Care Food Program Assistance Listing Numbers: 10.558 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2024 through June 30, 2025 Type of Finding: • Material Weakness in Internal Control over Compliance and Other Matters Criteria: Under the Uniform Guidance, costs charged to a federal award must be necessary, reasonable, allocable, consistent with the entity’s established policies, incurred during the award period, and adequately documented. In accordance with 2 CFR 200.403 and 2 CFR 200.430, payroll costs are allowable only when they are properly authorized and supported by records that accurately reflect the work performed. Accordingly, employee hours, including personal time off and overtime, should be recorded and compensated in the appropriate period based on the related time and effort performed. Condition: As part of our audit procedures, we selected a sample of 60 payroll transactions for review. Our testing included examining employee human resource files, including signed W-4 and I-9 forms, approved pay rates, timesheets with supervisory approval, and related payroll reports. We recalculated hours and compensation based on approved pay rates and compared the results to the payroll reports. During our review, we noted that management did not record and compensate all employee hours in the appropriate period based on the time and effort performed. Specifically, two employees were not properly compensated for one day of personal time off and 1.12 hours of overtime related to the administration of the CBS Food Program. These amounts were subsequently adjusted and paid in a later period. Questioned Costs: None Cause: Management did not consistently maintain and enforce internal controls over payroll documentation, review, and follow-up to ensure that payroll amounts, including personal time off and overtime, were accurately calculated, approved, and paid in the correct period. Although payroll support was maintained and available for audit, the review process did not identify the compensation differences before payroll was finalized, and the errors were not corrected until a subsequent period. Effect: Without proper documentation, approval, and timely review of payroll calculations, the Organization may charge unallowable, inaccurate, or inadequately supported compensation to the federal program. Payroll changes and compensation amounts, including personal time off and overtime, could be processed without appropriate authorization or correction in the proper period, increasing the risk of errors, unauthorized transactions, noncompliance with Uniform Guidance compensation requirements, and potential questioned costs. Repeat Finding: No Recommendation: We recommend that management strengthen its payroll review controls to ensure that employee compensation, including personal time off and overtime, is accurately calculated, reviewed, approved, and paid in the appropriate period. The review should include comparing approved timesheets, pay rates, payroll reports, and any leave or overtime documentation before payroll is finalized. Management should also document its review and establish a follow-up process to identify and correct payroll discrepancies timely. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan.
Federal Agencies: U.S. Department of Agriculture Federal Program Names: Child and Adult Care Food Program Assistance Listing Numbers: 10.558 Pass-Through Agency: Commonwealth of Pennsylvania, Department of Education Pass-Through Number: 359-46-477-8 Award Period: July 1, 2024 through June 30, 2025 Type of Finding: • Material Weakness in Internal Control over Compliance and Other Matters Criteria: The United States Government Accountability Office's Standards for Internal Control in the Federal Government, commonly known as the "Green Book," sets standards for an effective internal control system and concepts of the Green Book can be applied to non-profit entities. Green Book Principle 11 - Design Activities for the Information System, section 11.01 states, in part: Management should design the entity's information system and related control activities to achieve objectives and respond to risks. The following attributes contribute to the design, implementation, and operating effectiveness of this principle: Design of the Entity's Information System Design of Appropriate Types of Control Activities Design of Information Technology Infrastructure Design of Security Management Design of Information Technology Acquisition, Development, and Maintenance Condition: Based on the Commonwealth of Pennsylvania, Office of the Budget, Bureau of Audits (Commonwealth) review of CBS Food Program's financial accounting system, it was noted that the Food Program utilizes QuickBooks software for their accounting system. Based on inquiry with CBS Food Program management, we determined internal controls connected with their QuickBooks accounting software were insufficient in the following areas: • User Access Management: Formal written policies or procedures have not been developed and implemented related to access authorization, access monitoring, and removal of system access. Additionally, certain functions are not properly segregated as users have access to perform both input and authorization of transactions. • Input Management: Formal written policies or procedures to ensure information input into QuickBooks is appropriate and accurate have not been developed and implemented. • Change Control Management: A formal written change management policy for QuickBooks Accounting System has not been developed and implemented including requirements that system security updates are implemented timely. • Backup and Recovery: A formal written policy for regular backup and recovery testing has not been developed and implemented. Questioned Costs: None Cause: The CBS Food Program's lack of policies and procedures over QuickBooks may be due to inadequate resources, insufficient information technology governance, and/or a lack of awareness of information technology control requirements. Additionally, the CBS Food Program management may not place adequate focus on enforcing information technology control measures as part of the overall control environment. Effect: The lack of established and documented controls over QuickBooks increases the risk of unauthorized access, system disruption, and data loss. Additionally, without a written disaster recovery plan the Food Program is exposed to increased risks of prolonged downtime in the event of a disaster or system failure. These weaknesses may compromise the confidentiality, integrity, and availability of critical data. Repeat Finding: Yes Recommendation: We recommend that CBS Food Program develop and implement comprehensive written internal control policies and procedures connected with their QuickBooks Accounting System. This should include: • Development and utilization of an Accounting Manual which includes an outline of CBS Food Program's accounting rules, procedures, and guidelines. • Access control policies and procedures to ensure that user access to QuickBooks is appropriate, regularly reviewed and promptly revoked upon termination or when otherwise merited. • A formal written change management policy for QuickBooks should be developed and implemented including requirements that systems security updates are implemented timely. • A disaster recovery plan and procedures to perform periodic testing to ensure that plans are functional and mitigate the risk of extended downtime. This process should also include regular review of backup records to ensure they are appropriately created and maintained. Views of Responsible Officers and Corrective Action Plan: Please refer to Community Benefit Solutions dba CBS Food Program’s Corrective Action Plan.