Finding No.: 2023-050 AL Program: 97.036 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Contact Person(s): Patrick Guerrero, G...
Finding No.: 2023-050 AL Program: 97.036 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Contact Person(s): Patrick Guerrero, Governor’s Authorized Rep., PAO Corrective Action Plan: Condition 1-2: The CNMI Public Assistance Office (PAO) acknowledges and agrees with the compliance deficiencies identified regarding subrecipient monitoring and documentation requirements under 2 CFR §200.332 and has developed corrective actions to address these weaknesses. However, PAO respectfully disagrees with the questioned cost determination. The finding relates to deficiencies in monitoring procedures and documentation rather than the allowability, eligibility, or support for the underlying expenditures. The expenditures identified were associated Finding No.: 2023-050, continued AL Program: 97.036 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Contact Person(s): Patrick Guerrero, Governor’s Authorized Rep., PAO Corrective Action Plan: with FEMA-approved projects and no specific costs were identified as unallowable, unsupported, outside the approved scope of work, or otherwise ineligible for federal participation. While PAO recognizes that monitoring documentation was insufficient to demonstrate compliance with subrecipient monitoring requirements, PAO believes the appropriate classification is a compliance finding without questioned costs. Accordingly, PAO respectfully requests consideration that questioned costs associated with this finding be reduced to $0. Subrecipient monitoring activities were historically performed alongside project management responsibilities and were not supported by a centralized tracking system. As the number and complexity of Public Assistance projects increased, monitoring activities, documentation, and audit follow-up procedures were not consistently performed or documented. In addition, delays in the completion of CNMI-wide Single Audits and limited responsiveness from certain subrecipients affected PAO's ability to obtain timely financial reports, audit reports, and supporting documentation. PAO is implementing corrective actions in phases to establish a sustainable and documented subrecipient monitoring framework. Phase I – Immediate Actions (Completed/In Progress) • Responsibility for subrecipient monitoring activities has been assigned to the Compliance Manager and Risk Officer to provide dedicated oversight independent of project management functions. • PAO has begun conducting biannual subrecipient risk assessments and documenting risk ratings for active subrecipients. • For nonresponsive subrecipients, PAO will maintain documentation of all attempts to obtain required information and will perform additional follow-up as appropriate. These records will be maintained as evidence of monitoring activities and due diligence. • Standardized monitoring checklists, risk assessment forms, audit review checklists, and follow-up procedures are being developed to improve consistency and documentation. Finding No.: 2023-050, continued AL Program: 97.036 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Contact Person(s): Patrick Guerrero, Governor’s Authorized Rep., PAO Corrective Action Plan: • PAO will initiate a centralized tracking process using existing tools, including Excel spreadsheets and shared electronic files, to monitor: o Subrecipient risk assessments. o Financial and performance report submissions. o Single Audit report status. o Monitoring activities performed. o Corrective actions and follow-up requirements. o PAO will continue to document requests for financial reports, audit reports, risk assessment information, and other monitoring documentation. Supporting records, including request emails, follow-up correspondence, meeting invitations, telephone call logs, and responses received from subrecipients, will be retained to demonstrate monitoring efforts and follow-up actions. Phase II – Process Formalization • PAO will finalize written updates to the Subrecipient Monitoring Procedures establishing requirements for: o Risk assessments. o Monitoring frequency. o Financial and performance report reviews. o Single Audit follow-up. o Documentation retention. o Escalation procedures for nonresponsive subrecipients; and o Management review. • PAO will establish a formal Subrecipient Monitoring Register that consolidates monitoring activities, risk ratings, audit status, corrective actions, compliance deadlines, and follow-up actions. • Quarterly management reviews will be implemented to monitor completion of required monitoring activities, assess high-risk subrecipients, and address outstanding compliance issues. • PAO will establish formal procedures to review subrecipient Single Audit reports, verify reporting of FEMA-funded expenditures on the SEFA, document audit reviews, and track corrective actions resulting from audit findings. Finding No.: 2023-050, continued AL Program: 97.036 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) COVID-19 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Area: Subrecipient Monitoring Questioned Costs: $7,350,898 Contact Person(s): Patrick Guerrero, Governor’s Authorized Rep., PAO Corrective Action Plan: Phase III – Compliance & Monitoring Portal (Future Implementation) • Upon acquisition and implementation of Microsoft 365 resources, PAO will develop a centralized Compliance & Monitoring Portal to serve as the official repository for subrecipient monitoring records. • The portal will include electronic tracking of risk assessments, monitoring activities, audit findings, corrective actions, reporting deadlines, communication logs, and supporting documentation. • Automated reminders, management dashboards, workflow tracking, and document retention controls will be incorporated to strengthen oversight and improve monitoring documentation. These corrective actions will establish a documented, risk-based monitoring framework that improves oversight of subrecipients, strengthens documentation and audit trails, formalizes monitoring procedures, enhances accountability through dedicated compliance personnel, and improves compliance with the requirements of 2 CFR §200.332. Phase I – Ongoing Phase II – June 30, 2027 Phase III – Upon acquisition and implementation of Microsoft 365 resources and completion of staff training. Proposed Completion Date: June 30, 2027 (For Phase II). Phase I & II is Ongoing.