Reporting a determination that an applicant is not qualified for a Federal award.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001: Non-Compliance with Suspension and Debarment Information on the Federal Programs: 98.001 Criteria or Specific Requirement (including Statutory, Regulatory, or Other Citation): Under 2 CFR ?200.213, non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The non-Federal entity must verify that the person with whom you intend to do business is not excluded or disqualified, by (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Condition: It is our understanding that the Organization only includes self-certification paragraphs in all vendor contracts. The Organization did not, however, in any instance, perform screenings on its potential or current vendors, suppliers, contractors or non-domestic employees that were paid with Federal funds. Cause: The Organization does not have a formal internal policy with respect to screening vendors, suppliers, contractors or non-domestic employees. Effect or Potential Effect: Failure to screen potential and current vendors, suppliers, contractors, and non-domestic employees increases the potential that Federal funds be inadvertently provided to parties deemed to be suspended or disbarred by the United States Government. Questioned Costs: None noted. Context: Our audit procedures consisted of testwork completed on individual expenditures charged to the Federal awards. The report in which samples were selected was generated directly from the Organization's general ledger (accounting system). We consider our sample to be representative of the population. The condition appeared to be systemic in nature. Identification as a Repeat Finding, if Applicable: Not a repeat finding. Recommendation: We recommend that management develop and implement a formal policy regarding when suspension and debarment checks are conducted, and when a self-certification is sufficient. This policy should include a threshold, generally $25,000, for when vendors, suppliers, contractors or non-domestic employees should be screened. All screenings should be conducted prior to signing a contract or issuing payment.
2022-002 Federal Agency: Department of Agriculture (USDA) Pass-Through Entity: State of New York Executive Department of General Services Assistance Listing Numbers: 10.568 , 10.569 Pass-through Grant Numbers: 4NY810809, 4NY100105, 4NY430803, 8NY200100 Program Name: The Emergency Food Assistance Program (TEFAP), Food Distribution Cluster Criteria: : 2 CFR Section 200.318 stipulates that a non-Federal entity must use its own documented procurement procedures which reflect applicable state, local, and tribal laws and regulations, provided that the procurements conform to applicable Federal law and the standards identified in Part 200 Subpart D. Additionally, 2 CFR Section 200.213 stipulates that no awards, subawards, or contracts be awarded to parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. Condition: During our testing, we noted the following: - The contractors utilized by the Food Bank in 2022 were not properly checked for compliance requirements regarding debarment. They did not have a control in place to ensure the contractors used for their covered transactions were not made with a debarred or suspended party. Cause: The Food Bank did not review compliance requirements related to procurement outlined in 2 CFR Section 200.318 and Section 200.213. Effect: The Food Bank is not in compliance with 2 CFR Section 200.213. The Food Bank is not performing required procedures, as a result, vendors that are not eligible for participation in Federal assistance programs or activities could be selected or the Food Bank could be overpaying for goods and services. Questioned Costs: None Context/Sampling: The Food Bank performed a subsequent review of all vendors paid with federal dollars under the major program, noting none of the vendors used were precluded from being paid with federal dollars. Repeat Finding: No Recommendation: We recommend that the Food Bank review the requirements of 2 CFR Section 200.213 and ensure that a review of the eligibility of potential vendors to participate in Federal assistance programs or activities is performed prior to disbursing funds to the vendor. View of Responsible Officials: Management agrees with the finding and will implement the recommendations.
2022-002 Federal Agency: Department of Agriculture (USDA) Pass-Through Entity: State of New York Executive Department of General Services Assistance Listing Numbers: 10.568 , 10.569 Pass-through Grant Numbers: 4NY810809, 4NY100105, 4NY430803, 8NY200100 Program Name: The Emergency Food Assistance Program (TEFAP), Food Distribution Cluster Criteria: : 2 CFR Section 200.318 stipulates that a non-Federal entity must use its own documented procurement procedures which reflect applicable state, local, and tribal laws and regulations, provided that the procurements conform to applicable Federal law and the standards identified in Part 200 Subpart D. Additionally, 2 CFR Section 200.213 stipulates that no awards, subawards, or contracts be awarded to parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. Condition: During our testing, we noted the following: - The contractors utilized by the Food Bank in 2022 were not properly checked for compliance requirements regarding debarment. They did not have a control in place to ensure the contractors used for their covered transactions were not made with a debarred or suspended party. Cause: The Food Bank did not review compliance requirements related to procurement outlined in 2 CFR Section 200.318 and Section 200.213. Effect: The Food Bank is not in compliance with 2 CFR Section 200.213. The Food Bank is not performing required procedures, as a result, vendors that are not eligible for participation in Federal assistance programs or activities could be selected or the Food Bank could be overpaying for goods and services. Questioned Costs: None Context/Sampling: The Food Bank performed a subsequent review of all vendors paid with federal dollars under the major program, noting none of the vendors used were precluded from being paid with federal dollars. Repeat Finding: No Recommendation: We recommend that the Food Bank review the requirements of 2 CFR Section 200.213 and ensure that a review of the eligibility of potential vendors to participate in Federal assistance programs or activities is performed prior to disbursing funds to the vendor. View of Responsible Officials: Management agrees with the finding and will implement the recommendations.
2022-002 Federal Agency: Department of Agriculture (USDA) Pass-Through Entity: State of New York Executive Department of General Services Assistance Listing Numbers: 10.568 , 10.569 Pass-through Grant Numbers: 4NY810809, 4NY100105, 4NY430803, 8NY200100 Program Name: The Emergency Food Assistance Program (TEFAP), Food Distribution Cluster Criteria: : 2 CFR Section 200.318 stipulates that a non-Federal entity must use its own documented procurement procedures which reflect applicable state, local, and tribal laws and regulations, provided that the procurements conform to applicable Federal law and the standards identified in Part 200 Subpart D. Additionally, 2 CFR Section 200.213 stipulates that no awards, subawards, or contracts be awarded to parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. Condition: During our testing, we noted the following: - The contractors utilized by the Food Bank in 2022 were not properly checked for compliance requirements regarding debarment. They did not have a control in place to ensure the contractors used for their covered transactions were not made with a debarred or suspended party. Cause: The Food Bank did not review compliance requirements related to procurement outlined in 2 CFR Section 200.318 and Section 200.213. Effect: The Food Bank is not in compliance with 2 CFR Section 200.213. The Food Bank is not performing required procedures, as a result, vendors that are not eligible for participation in Federal assistance programs or activities could be selected or the Food Bank could be overpaying for goods and services. Questioned Costs: None Context/Sampling: The Food Bank performed a subsequent review of all vendors paid with federal dollars under the major program, noting none of the vendors used were precluded from being paid with federal dollars. Repeat Finding: No Recommendation: We recommend that the Food Bank review the requirements of 2 CFR Section 200.213 and ensure that a review of the eligibility of potential vendors to participate in Federal assistance programs or activities is performed prior to disbursing funds to the vendor. View of Responsible Officials: Management agrees with the finding and will implement the recommendations.
2022-002 Federal Agency: Department of Agriculture (USDA) Pass-Through Entity: State of New York Executive Department of General Services Assistance Listing Numbers: 10.568 , 10.569 Pass-through Grant Numbers: 4NY810809, 4NY100105, 4NY430803, 8NY200100 Program Name: The Emergency Food Assistance Program (TEFAP), Food Distribution Cluster Criteria: : 2 CFR Section 200.318 stipulates that a non-Federal entity must use its own documented procurement procedures which reflect applicable state, local, and tribal laws and regulations, provided that the procurements conform to applicable Federal law and the standards identified in Part 200 Subpart D. Additionally, 2 CFR Section 200.213 stipulates that no awards, subawards, or contracts be awarded to parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. Condition: During our testing, we noted the following: - The contractors utilized by the Food Bank in 2022 were not properly checked for compliance requirements regarding debarment. They did not have a control in place to ensure the contractors used for their covered transactions were not made with a debarred or suspended party. Cause: The Food Bank did not review compliance requirements related to procurement outlined in 2 CFR Section 200.318 and Section 200.213. Effect: The Food Bank is not in compliance with 2 CFR Section 200.213. The Food Bank is not performing required procedures, as a result, vendors that are not eligible for participation in Federal assistance programs or activities could be selected or the Food Bank could be overpaying for goods and services. Questioned Costs: None Context/Sampling: The Food Bank performed a subsequent review of all vendors paid with federal dollars under the major program, noting none of the vendors used were precluded from being paid with federal dollars. Repeat Finding: No Recommendation: We recommend that the Food Bank review the requirements of 2 CFR Section 200.213 and ensure that a review of the eligibility of potential vendors to participate in Federal assistance programs or activities is performed prior to disbursing funds to the vendor. View of Responsible Officials: Management agrees with the finding and will implement the recommendations.
2022-002 Federal Agency: Department of Agriculture (USDA) Pass-Through Entity: State of New York Executive Department of General Services Assistance Listing Numbers: 10.568 , 10.569 Pass-through Grant Numbers: 4NY810809, 4NY100105, 4NY430803, 8NY200100 Program Name: The Emergency Food Assistance Program (TEFAP), Food Distribution Cluster Criteria: : 2 CFR Section 200.318 stipulates that a non-Federal entity must use its own documented procurement procedures which reflect applicable state, local, and tribal laws and regulations, provided that the procurements conform to applicable Federal law and the standards identified in Part 200 Subpart D. Additionally, 2 CFR Section 200.213 stipulates that no awards, subawards, or contracts be awarded to parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. Condition: During our testing, we noted the following: - The contractors utilized by the Food Bank in 2022 were not properly checked for compliance requirements regarding debarment. They did not have a control in place to ensure the contractors used for their covered transactions were not made with a debarred or suspended party. Cause: The Food Bank did not review compliance requirements related to procurement outlined in 2 CFR Section 200.318 and Section 200.213. Effect: The Food Bank is not in compliance with 2 CFR Section 200.213. The Food Bank is not performing required procedures, as a result, vendors that are not eligible for participation in Federal assistance programs or activities could be selected or the Food Bank could be overpaying for goods and services. Questioned Costs: None Context/Sampling: The Food Bank performed a subsequent review of all vendors paid with federal dollars under the major program, noting none of the vendors used were precluded from being paid with federal dollars. Repeat Finding: No Recommendation: We recommend that the Food Bank review the requirements of 2 CFR Section 200.213 and ensure that a review of the eligibility of potential vendors to participate in Federal assistance programs or activities is performed prior to disbursing funds to the vendor. View of Responsible Officials: Management agrees with the finding and will implement the recommendations.
Finding 2022-002 ? Procurement and Suspension and Debarment Identification of the federal program: Federal Agencies: U.S. Department of Health and Human Services Pass-Through Entities: Ohio Department of Health Assistance Listing No: 93.354 Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response Award Period: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? The Uniform Guidance 2 CFR Section 200.213 states, ?Non-federal entities are subject to the non- procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities?. Condition: We identified the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Akron Children?s. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Akron Children?s relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) Akron Children?s conducts preventive controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Akron Children?s transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Akron Children?s does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred (c) Akron Children?s did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Akron Children?s to the third-party vendor. Cause: Akron Children?s does not have policies and procedures that require a validation of the third party?s controls be performed to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match. Akron Children?s did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the procurement system. In addition, Akron Children?s did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Akron Children?s screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Akron Children?s from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: None. Context: The federal portion of expenditures subject to suspension and debarment represents approximately 16% of total federal expenditures for the program of $1,085,801 for the year ended December 31, 2022. Identification as a repeat finding, if applicable: The finding is not a repeat finding from the prior year. Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for ?new? vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: The third-party vendor used for this service does not have a system and organizational controls report available that would have been relevant to this requirement. Therefore, Akron Children?s will implement a periodic independent review of a sample of vendors sent to the third-party vendor to ensure that the processes employed by third-party vendor are accurate. Akron Children?s will also develop a retention process for all vendor searches and file submissions to evidence compliance with the Federal regulations. Further, a contract management system has been installed in 2023 that holds the validation of new vendors as acceptable for federal procurements.
Finding 2022-007: Suspension and Debarment Criteria: Under 2 CFR §200.213, Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The non-Federal entity must verify that the person with whom you intend to do business is not excluded or disqualified, by (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Condition: During our testing over Suspension and Debarment, we determined that SAMU did not perform screenings on potential or current vendors, suppliers, contractors or employees that were paid with Federal funds. Cause: SAMU does not have a formal internal policy with respect to screening vendors, suppliers, contractors and employees in order to adhere to compliance over suspension and debarment. Effect or Potential Effect: Failure to screen potential and current vendors, suppliers, contractors and employees increases the potential that Federal funds be inadvertently provided to parties deemed to be suspended or disbarred by the United States Government. Questioned Costs: None. Context: We noted that vendors, suppliers, contractors and employees selected for testing did not have a formally documented Suspension and Debarment check conducted prior to engagement. Identification as a Repeat Finding, if Applicable: Not applicable. Recommendation: We recommend that management develop and implement a formal policy on suspension and debarment. This policy should include a threshold for when vendors, suppliers, contractors and employees should be screened. All screenings should be conducted prior to signing a contract or issuing payment. We recommend that SAMU notify all employees of this policy and ensure that it is enforced during the upcoming fiscal year.
Finding 2022-004: Suspension and Debarment Criteria: Under 2 CFR §200.213, Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The non-Federal entity must verify that the person with whom you intend to do business is not excluded or disqualified, by (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Condition: During our testing over Suspension and Debarment, we determined that USTTI did not perform screenings on potential or current vendors, suppliers or contractors that were paid with Federal funds. Cause: USTTI does not have a formal internal policy with respect to screening vendors, suppliers, contractors and employees in order to adhere to compliance over suspension and debarment. Effect: Failure to screen potential and current vendors, suppliers, contractors and employees increases the potential that Federal funds be inadvertently provided to parties deemed to be suspended or disbarred by the United States Government. Questioned Costs: None. Context: We noted that vendors, suppliers etc. selected for testing did not have a formally documented Suspension and Debarment check conducted prior to engagement. Identification as a Repeat Finding, if Applicable: Not applicable. Recommendation: We recommend that management develop and implement a formal policy on suspension and debarment. This policy should include a threshold for when vendors, suppliers, contractors and employees should be screened. All screenings should be conducted prior to signing a contract or issuing payment. We recommend that USTTI notify all employees of this policy and ensure that it is enforced during the upcoming fiscal year.
Finding 2022-004: Suspension and Debarment Criteria: Under 2 CFR §200.213, Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The non-Federal entity must verify that the person with whom you intend to do business is not excluded or disqualified, by (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Condition: During our testing over Suspension and Debarment, we determined that USTTI did not perform screenings on potential or current vendors, suppliers or contractors that were paid with Federal funds. Cause: USTTI does not have a formal internal policy with respect to screening vendors, suppliers, contractors and employees in order to adhere to compliance over suspension and debarment. Effect: Failure to screen potential and current vendors, suppliers, contractors and employees increases the potential that Federal funds be inadvertently provided to parties deemed to be suspended or disbarred by the United States Government. Questioned Costs: None. Context: We noted that vendors, suppliers etc. selected for testing did not have a formally documented Suspension and Debarment check conducted prior to engagement. Identification as a Repeat Finding, if Applicable: Not applicable. Recommendation: We recommend that management develop and implement a formal policy on suspension and debarment. This policy should include a threshold for when vendors, suppliers, contractors and employees should be screened. All screenings should be conducted prior to signing a contract or issuing payment. We recommend that USTTI notify all employees of this policy and ensure that it is enforced during the upcoming fiscal year.
Finding 2022-004: Suspension and Debarment Criteria: Under 2 CFR §200.213, Non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The non-Federal entity must verify that the person with whom you intend to do business is not excluded or disqualified, by (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Condition: During our testing over Suspension and Debarment, we determined that USTTI did not perform screenings on potential or current vendors, suppliers or contractors that were paid with Federal funds. Cause: USTTI does not have a formal internal policy with respect to screening vendors, suppliers, contractors and employees in order to adhere to compliance over suspension and debarment. Effect: Failure to screen potential and current vendors, suppliers, contractors and employees increases the potential that Federal funds be inadvertently provided to parties deemed to be suspended or disbarred by the United States Government. Questioned Costs: None. Context: We noted that vendors, suppliers etc. selected for testing did not have a formally documented Suspension and Debarment check conducted prior to engagement. Identification as a Repeat Finding, if Applicable: Not applicable. Recommendation: We recommend that management develop and implement a formal policy on suspension and debarment. This policy should include a threshold for when vendors, suppliers, contractors and employees should be screened. All screenings should be conducted prior to signing a contract or issuing payment. We recommend that USTTI notify all employees of this policy and ensure that it is enforced during the upcoming fiscal year.
Information on the Federal Programs: All Programs Criteria: CFR 200.213 states that non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The non-Federal entity must verify that the person with whom you intend to do business is not excluded or disqualified, by (a) checking SAM Exclusions; (b) collecting a certification from that person; (c) adding a clause or condition to the covered transaction with that person. Additionally, as outlined in each Department of State award, recipients of U.S. Government funds must adhere to the United States Government’s requirements on screening all potential vendors, suppliers, subcontractors/grantees and employees against the United States Department of State’s Terrorism watch list. The screening of all potential vendors, suppliers, sub-contractors/grantees and employees must be documented in writing. Condition: The Organization did not provide timely/contemporaneous documentation to support its screenings for its potential and current vendors, suppliers, contractors, employees, etc. that were paid with Federal funds during the year under audit. Cause: The Organization did not follow its internal policy with respect to screening vendors, suppliers, contractors and employees in order to adhere to compliance over suspension and debarment. Context: Our audit procedures consisted of testwork completed on individual expenditures charged to the Federal awards. The report in which samples were selected was generated directly from the Organization's general ledger (accounting system). We consider our sample to be representative of the population. The condition appeared to be systemic in nature. Effect: The Organization could make payments to an entity or individual that has been debarred or suspended by the US Government; such costs would be disallowed, and the Organization could face consequences for lack of compliance. Questioned Costs: None noted. Identification as a Repeat Finding: N/A Recommendation: We recommend the Organization adhere to its policy of how screenings will be performed and how contemporaneous documentation will be maintained in order to demonstrate compliance with government regulations.
Information on the Federal Programs: All Programs Criteria: CFR 200.213 states that non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The non-Federal entity must verify that the person with whom you intend to do business is not excluded or disqualified, by (a) checking SAM Exclusions; (b) collecting a certification from that person; (c) adding a clause or condition to the covered transaction with that person. Additionally, as outlined in each Department of State award, recipients of U.S. Government funds must adhere to the United States Government’s requirements on screening all potential vendors, suppliers, subcontractors/grantees and employees against the United States Department of State’s Terrorism watch list. The screening of all potential vendors, suppliers, sub-contractors/grantees and employees must be documented in writing. Condition: The Organization did not provide timely/contemporaneous documentation to support its screenings for its potential and current vendors, suppliers, contractors, employees, etc. that were paid with Federal funds during the year under audit. Cause: The Organization did not follow its internal policy with respect to screening vendors, suppliers, contractors and employees in order to adhere to compliance over suspension and debarment. Context: Our audit procedures consisted of testwork completed on individual expenditures charged to the Federal awards. The report in which samples were selected was generated directly from the Organization's general ledger (accounting system). We consider our sample to be representative of the population. The condition appeared to be systemic in nature. Effect: The Organization could make payments to an entity or individual that has been debarred or suspended by the US Government; such costs would be disallowed, and the Organization could face consequences for lack of compliance. Questioned Costs: None noted. Identification as a Repeat Finding: N/A Recommendation: We recommend the Organization adhere to its policy of how screenings will be performed and how contemporaneous documentation will be maintained in order to demonstrate compliance with government regulations.
Information on the Federal Programs: All Programs Criteria: CFR 200.213 states that non-Federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The non-Federal entity must verify that the person with whom you intend to do business is not excluded or disqualified, by (a) checking SAM Exclusions; (b) collecting a certification from that person; (c) adding a clause or condition to the covered transaction with that person. Additionally, as outlined in each Department of State award, recipients of U.S. Government funds must adhere to the United States Government’s requirements on screening all potential vendors, suppliers, subcontractors/grantees and employees against the United States Department of State’s Terrorism watch list. The screening of all potential vendors, suppliers, sub-contractors/grantees and employees must be documented in writing. Condition: The Organization did not provide timely/contemporaneous documentation to support its screenings for its potential and current vendors, suppliers, contractors, employees, etc. that were paid with Federal funds during the year under audit. Cause: The Organization did not follow its internal policy with respect to screening vendors, suppliers, contractors and employees in order to adhere to compliance over suspension and debarment. Context: Our audit procedures consisted of testwork completed on individual expenditures charged to the Federal awards. The report in which samples were selected was generated directly from the Organization's general ledger (accounting system). We consider our sample to be representative of the population. The condition appeared to be systemic in nature. Effect: The Organization could make payments to an entity or individual that has been debarred or suspended by the US Government; such costs would be disallowed, and the Organization could face consequences for lack of compliance. Questioned Costs: None noted. Identification as a Repeat Finding: N/A Recommendation: We recommend the Organization adhere to its policy of how screenings will be performed and how contemporaneous documentation will be maintained in order to demonstrate compliance with government regulations.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.
Finding 2022-001 Identification of the federal program: Federal Agency: Various Assistance Listing: Various; Research and Development Cluster Award Year: 2022 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." The Uniform Guidance 2 CFR Section 200.213 states, "Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR Part 180. These regulations restrict awards, subawards, and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities". Condition: We noted the following matters during our testing of suspension and debarment control processes: (a) A third-party vendor performed the suspension and debarment validation process for Sanford. The third-party vendor does not have a SOC 1 (System and Organization Controls) Report. Sanford relied on the suspension and debarment checks performed by the third-party vendor for results concluding no match without completing a validation control to ensure the results provided by the third party were accurate. (b) To ensure compliance with 2 CFR Section 200.213, Sanford conducts both preventive and detective controls in its vendor setup and monitoring process to ensure new vendors and active vendors are not suspended or debarred. A consistent vendor setup process is followed for each new vendor that Sanford transacts with, regardless of whether the vendor transactions are funded through federal grant funding or through other sources. To prevent a suspended or debarred vendor from being added as a new vendor, the vendor is checked against the suspension and debarment database electronically before completion of the vendor setup. Subsequent to vendor setup, Sanford also monitors the status of its vendors to ensure the vendor's status has not changed. Sanford does not retain the supporting documentation that the vendor setup check resulted in no match in the suspension and debarment database indicating the vendor is not suspended or debarred. (c) Sanford did not retain the supporting documentation of the reconciliation of the vendor list that is received from the third-party vendor that is used to perform the suspension and debarment checks after the suspension and debarment checks are performed to ensure the listing is complete and agrees to the vendor list provided by Sanford to the third-party vendor. Cause: Sanford utilizes a third-party vendor to perform suspension and debarment checks on its vendors, both during the vendor setup process as well as ongoing monitoring of active vendors. Sanford did not add an additional validation control to ensure that the suspension and debarment checks performed by the third-party vendor aligned with the governmental suspension and debarment database when the search resulted in no match Sanford did not have policies and procedures in place to require that documentation is retained of its suspension and debarment checks performed when a new vendor is set up in the system if the vendor check resulted in no match with the suspension and debarment database indicating the vendor is not suspended or debarred. In addition, Sanford did not have policies and procedures in place to require that documentation is retained to support the reconciliations performed for ongoing monitoring purposes between the vendor list sent to the third-party vendor and the results provided by the third-party vendor. Effect or potential effect: Sanford's screening for suspension and debarment through the third-party vendor results may not be accurate. By failing to retain the documentation of the reconciliation of vendor files to the third-party vendor search results, sufficient evidence was not retained to prove that the reconciliation took place. As a result, there was not sufficient evidence to validate the appropriate internal controls took place to prevent Sanford from transacting with a vendor that was suspended or debarred, which was ultimately charged to a federal program. Questioned costs: $0 Context: The federal portion of expenditures subject to suspension and debarment was approximately $1,300,000, which represents approximately 10% of the Research and Development Cluster federal expenditures, of which no vendors were determined to be suspended or debarred. The total amount reported on the SEFA for R&D cluster is $13,361,367. Identification as a repeat finding, if applicable: Not applicable Recommendation: Management should add controls to validate the accuracy of the suspension and debarment search results performed by the third-party vendor when the search results in no match. Management should implement documentation retention processes to provide evidence over the suspension and debarment search for "new" vendors. In addition, management should implement documentation retention processes over the reconciliation between the vendor list sent to the third-party vendor to document completeness of the suspension and debarment check. Views of responsible officials: As it relates to the reliance on the third-party vendor that conducts suspension and debarment -party vendor searches, the third party vendor provides Sanford a SOC (System and Organizational Controls) 2 Type II report annually over the effectiveness of its controls. This is reviewed by Sanford?s compliance department to ensure that there are no findings that would be of concern to Sanford?s reliance on the vendor transaction. Considering the third-party vendor is not relied upon for financial controls, the third-party vendor does not have a SOC 1 (System and Organization Controls) Report and therefore did not provide this level of report to Sanford. To provide context on scale of vendors subject to suspension and debarment, Sanford paid a total of 27,000 vendors in 2022. There were three vendors identified through the vendor setup and monitoring process to be suspended or debarred. None of those vendors were associated with the programs funded with federal funds. Sanford?s preventive and detective controls and operating procedures provide reasonable assurance over the effectiveness of the controls necessary to prevent the risk of federal funds being paid to vendors that are suspended or disbarred. Sanford believes the risk of any material disbursement to suspended and debarred vendors is effectively mitigated through existing preventive and detective internal controls. Sanford will document a periodic validation of the suspension and debarment search results performed by the third-party vendor for vendor searches that yield no suspension and debarment match. In addition, Sanford will enhance its procedural documentation regarding retention of evidence related to reconciliation of vendor list when discrepancies are identified and the suspension and debarment results that is generated through the vendor setup process.