Finding number: 2023-005 Significant Deficiency in Internal Control Over Compliance: Allowable Costs and Activities Federal Program #1 HIV Emergency Relief Project Grants: CFDA Number 93.914 Federal Program #2 HIV Care Formula Grants: CFDA Number 93.917 Federal Program #3 HIV Prevention Activities: CFDA Number: 93.941 Name of federal agency: U.S. Department of Health and Human Services (HHS) Name of pass-through entity: Multiple Repeat finding: No AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Criteria: Under 2 CFR §200.303, recipients of federal funds must establish and maintain effective internal controls to ensure compliance with federal statutes, regulations, and the terms of grant agreements. 2 CFR §200.403 specifies that costs charged to federal programs must be allowable, necessary, reasonable, and allocable to the respective award. Additionally, 2 CFR §200.302 requires financial management systems to provide effective control and accountability over federal funds, including documented approval of expenditures. A best practice for grant compliance is to implement a documented approval process for expenditures charged to federal programs, ensuring that all costs are reviewed and supported by adequate documentation before reimbursement requests are submitted. Condition: The Organization did not have readily-available documented evidence of review and approval for expenditures charged to federal grants during the fiscal year. Specifically: The financial system did not capture or document approval of expenditures before they were charged to federal programs. No formalized system existed to retain evidence of grant-related expenditure reviews. While the prior Chief Financial Officer (CFO) manually reviewed each invoice, there was no indication of approval on the supporting documentation, making it impossible to verify that an appropriate review occurred before costs were charged to the grants. Cause: The issue arose due to the Organization's reliance on a manual review process conducted by the previous CFO, without requiring a formal approval signature or electronic system control to document review. This lack of a structured approval process resulted in insufficient evidence to support compliance with federal allowable cost requirements. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Possible effect: Without a documented approval process, the Organization cannot demonstrate that expenditures charged to the grants were properly reviewed for allowability, reasonableness, and allocability in accordance with federal regulations. This increases the risk that: Unallowable or misclassified expenditures could be charged to the grants without detection. Noncompliance with federal grant requirements could result in questioned costs or additional oversight from funding agencies. Financial statement and grant reporting inaccuracies may occur if expenditures are not properly reviewed and approved. Although no specific unallowable costs were identified during the audit, the lack of documented review represents a significant deficiency in internal control over compliance. Questioned cost: None identified at this time. Recommendation: We recommend that the Organization strengthen its internal controls over grant expenditures by implementing the following measures: 1. Implement a Formal Expenditure Review and Approval Policy – Establish a policy requiring that all expenditures charged to grants be reviewed and approved by an appropriate individual before being recorded in the system. 2. Require Documentation of Review and Approval – Ensure that invoices, payroll allocations, and other cost support documents include a signature, initials, or system-generated approval to confirm review. 3. Utilize System-Based Controls – If possible, configure the financial system to require electronic approval for all grant-related expenditures before costs are recorded. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Views of responsible officials: Management partially agrees with the finding. While we acknowledge that documentation of expenditure approval was not always retrievable, we believe the expenditures reviewed were all appropriate. Finding 2023-005 refers to the auditors' assessment of expenditure review and approval processes that occurred in Calendar Year 2023. During Calendar Year 2023, Prism relied on email routing of expenditures for review and approval. As of this writing, Prism Health North Texas' expenditure review and approval processes already meet or exceed the recommendations above. Action Taken: Expenditure Review – All expenditures charged to grants are reviewed and approved by two qualified individuals. Documentation of Review and Approval – Such review and approval for non-payroll expenditures occur in and are documented in the SAP Concur software before the costs are recorded in the accounting system (Abila). Such review and approval for payroll-related expenditures occur via and are documented via a combination of methods, also before they are recorded in Abila. Employees report their time, including how much time was devoted to grant activities, in the ExponentHR payroll system, and their supervisors approve both the time and the allocation in that system. Programmatic measures that also support grant billing ("units") are calculated from activity documented in the athenaOne electronic health record (EHR). Payroll allocation is calculated by one person, based on the ExponentHR documentation and the units, then reviewed and imported into Abila by a second person. The unposted transactions are reviewed again before posting. Utilize System-Based Controls – In place as above. _________________________________________________________
Finding number: 2023-004 – Material Weakness in Internal Control Over Preparation, Reconciliation, and Retention of the Schedule of Expenditures of Federal Awards (SEFA) Federal Program #1 HIV Emergency Relief Project Grants: CFDA Number: 93.914 Federal Program #2 HIV Care Formula Grants): CFDA Number: 93.917 Federal Program #3: HIV Prevention Activities: CFDA Number: 93.941 Name of federal agency: U.S. Department of Health and Human Services (HHS) Name of pass-through entity: Multiple Repeat finding: No AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Criteria: Under 2 CFR §200.510(b), recipients of federal funds are required to prepare a Schedule of Expenditures of Federal Awards (SEFA) that fairly presents federal expenditures for each grant program and is derived from and supported by the entity's accounting records. Additionally, 2 CFR §200.302 requires that financial management systems adequately identify and account for federal awards to ensure accuracy and compliance with applicable federal requirements. Best practices dictate that federal expenditures should be reconciled regularly to the general ledger, and supporting documentation should be maintained to substantiate amounts reported on the SEFA. Condition: The Organization lacked adequate controls over the preparation, reconciliation, and retention of records related to the SEFA. Specifically: The SEFA incorrectly reported certain federal awards as non-federal awards. The SEFA is prepared based on amounts requested for reimbursement instead of directly based on expenditures incurred. Reconciliation schedules that tied SEFA expenditures directly back to the expenses recorded in the general ledger could not be located. Expenses recorded in the general ledger represent expenses incurred to operate the program in addition to direct grant expenditures; the Organization only requests reimbursement for direct program expenditures allowable under the program. Documentation of Excel-based reconciliations did not agree to reported monthly expenditures, indicating manual reclassification entries between program codes that were not clearly supported. Cause: The deficiencies noted were primarily due to: Lack of system controls to ensure that state and federal expenditures were separately tracked from non-grant funds spent within the same source codes. Turnover in grants management personnel, which resulted in missing, incomplete, or inaccurate reconciling records. Possible effect: Without a complete and accurate SEFA, the Organization risks noncompliance with Uniform Guidance reporting requirements, which could impact its ability to receive and administer federal funds in the future. Additionally, inaccurate SEFA reporting increases the risk of errors in administering funds, questioned costs, and over or under expenditure of grants. Questioned cost: None identified at this time. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Recommendation: We recommend that the Organization implement the following measures to improve SEFA preparation and record retention: 1. Develop a Standardized SEFA Reconciliation Process – Implement formal policies and procedures requiring that SEFA expenditures be reconciled to the general ledger on a monthly basis, with documentation maintained for audit purposes. 2. Enhance System Controls for Grant Expenditures – Modify the financial system to allow for the proper segregation of state and federal expenditures from non-grant funds, ensuring that expenditures are properly classified at the time of entry. 3. Require Monthly Documentation Reviews – Establish a control requiring management to review and approve SEFA reconciliation schedules on a monthly or quarterly basis to ensure accuracy and completeness. 4. Implement a Centralized Documentation Retention Policy – Require that all SEFA-related reconciliation records, including general ledger tie-outs and manual adjustments, be retained in a centralized, accessible location. 5. Provide Grants Management Training – Conduct training for grants management and accounting personnel on SEFA preparation requirements, including Uniform Guidance compliance and best practices for documentation and reconciliation. 6. By implementing these measures, the Organization can improve its internal controls over SEFA preparation, ensure compliance with Uniform Guidance, and reduce the risk of reporting inaccuracies. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Views of responsible officials: Management partially agrees with the finding. While we acknowledge that documentation supporting SEFA reconciliation was incomplete, we believe that federal expenditures were properly accounted for. We would like to address some of the auditors' points individually: "The SEFA is prepared based on amounts requested for reimbursement instead of directly based on expenditures incurred." Most grant awards do not fully fund the programs they support, most grant awards do not run concurrently with Prism Health North Texas' fiscal year (i.e., with the Calendar Year), and most grant awards are not spent in equal monthly amounts. It is correct that the 2023 SEFA was based on grant-appropriate expenditures that occurred during Calendar Year 2023 and were submitted to those grant sponsors for reimbursement. This will not necessarily reach the full cost to Prism for each grant-supported program, nor is it likely to exactly match any annual grant award amount. "Expenses recorded in the general ledger represent expenses incurred to operate the program in addition to direct grant expenditures; the Organization only requests reimbursement for direct program expenditures allowable under the program." As we confirmed verbally with the audit partner on April 25, 2025, this statement is intended to provide information and context and is not a criticism or intended to point out any problem. As stated above, most grant awards do not fully fund the programs they support; therefore, the general ledger necessarily includes both expenses the sponsor will reimburse and expenses the sponsor will not reimburse. Nonetheless, we are enhancing our reconciliation procedures and documentation practices to fully meet audit requirements. Finding 2023-004 refers to the auditors' assessment of the SEFA preparation and reconciliation processes that occurred in Calendar Year 2023. As of this writing, Prism Health North Texas has already changed its SEFA preparation and reconciliation processes and meets many of the recommendations above. Action Taken: Documentation Retention – On April 25, 2025, management created a structured and easily accessible system for storing all relevant information for all grants management personnel. A logical naming system for files identifying the SEFA period, the funding agency and identified general ledger expenditures claimed on the SEFA. We are now documenting the difference between all GL transactions and those submitted for sponsor reimbursement (i.e., SEFA components) in a single document per fund code, arranged by fiscal year. Previously this documentation was kept by invoice and arranged by grant year. Management will continue to ensure all expenditure-related support, such as invoices and purchase orders, is saved electronically to all AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) financial transactions. SEFA Reconciliation – Management has decided to move from an annual to quarterly SEFA reconciliation process to enhance the frequency of management oversight in SEFA draft preparation. VP of Finance will prepare the SEFA for independent review by the CFO. This will be put into a written policy/procedure. System Enhancements – Prism's current accounting system does not accommodate this. However, Prism is already in the later stages of selecting a new Enterprise Resource Planning (ERP) solution, with this as one of our key selection criteria. Our new ERP should allow for expenditures within the same cost center to be identified as grant-reimbursable or non-grant-reimbursable at the time of entry. We have identified opportunities in new financial management software solutions that we are scheduled to demo May 12th and the 16th of 2025. Opportunities such as: The ability to tag grant-reimbursable transactions, to segment our award cost center into two important categories. The full cost to manage a specific program. Identified cost claimed on the SEFA. Dedicated grant modules that will allow us to establish business rules and workflows to streamline and digitize critical aspects of grant management. Staff Engagement – Cross department coordination meetings occur monthly between the Finance organization and the Grants Management team to continue to foster alignment and collaboration in our grant cycles. A general overview of SEFA, including how to prepare and organize the monthly reconciliations, has already occurred with some of the grants accountants. _________________________________________________________
Finding number: 2023-005 Significant Deficiency in Internal Control Over Compliance: Allowable Costs and Activities Federal Program #1 HIV Emergency Relief Project Grants: CFDA Number 93.914 Federal Program #2 HIV Care Formula Grants: CFDA Number 93.917 Federal Program #3 HIV Prevention Activities: CFDA Number: 93.941 Name of federal agency: U.S. Department of Health and Human Services (HHS) Name of pass-through entity: Multiple Repeat finding: No AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Criteria: Under 2 CFR §200.303, recipients of federal funds must establish and maintain effective internal controls to ensure compliance with federal statutes, regulations, and the terms of grant agreements. 2 CFR §200.403 specifies that costs charged to federal programs must be allowable, necessary, reasonable, and allocable to the respective award. Additionally, 2 CFR §200.302 requires financial management systems to provide effective control and accountability over federal funds, including documented approval of expenditures. A best practice for grant compliance is to implement a documented approval process for expenditures charged to federal programs, ensuring that all costs are reviewed and supported by adequate documentation before reimbursement requests are submitted. Condition: The Organization did not have readily-available documented evidence of review and approval for expenditures charged to federal grants during the fiscal year. Specifically: The financial system did not capture or document approval of expenditures before they were charged to federal programs. No formalized system existed to retain evidence of grant-related expenditure reviews. While the prior Chief Financial Officer (CFO) manually reviewed each invoice, there was no indication of approval on the supporting documentation, making it impossible to verify that an appropriate review occurred before costs were charged to the grants. Cause: The issue arose due to the Organization's reliance on a manual review process conducted by the previous CFO, without requiring a formal approval signature or electronic system control to document review. This lack of a structured approval process resulted in insufficient evidence to support compliance with federal allowable cost requirements. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Possible effect: Without a documented approval process, the Organization cannot demonstrate that expenditures charged to the grants were properly reviewed for allowability, reasonableness, and allocability in accordance with federal regulations. This increases the risk that: Unallowable or misclassified expenditures could be charged to the grants without detection. Noncompliance with federal grant requirements could result in questioned costs or additional oversight from funding agencies. Financial statement and grant reporting inaccuracies may occur if expenditures are not properly reviewed and approved. Although no specific unallowable costs were identified during the audit, the lack of documented review represents a significant deficiency in internal control over compliance. Questioned cost: None identified at this time. Recommendation: We recommend that the Organization strengthen its internal controls over grant expenditures by implementing the following measures: 1. Implement a Formal Expenditure Review and Approval Policy – Establish a policy requiring that all expenditures charged to grants be reviewed and approved by an appropriate individual before being recorded in the system. 2. Require Documentation of Review and Approval – Ensure that invoices, payroll allocations, and other cost support documents include a signature, initials, or system-generated approval to confirm review. 3. Utilize System-Based Controls – If possible, configure the financial system to require electronic approval for all grant-related expenditures before costs are recorded. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Views of responsible officials: Management partially agrees with the finding. While we acknowledge that documentation of expenditure approval was not always retrievable, we believe the expenditures reviewed were all appropriate. Finding 2023-005 refers to the auditors' assessment of expenditure review and approval processes that occurred in Calendar Year 2023. During Calendar Year 2023, Prism relied on email routing of expenditures for review and approval. As of this writing, Prism Health North Texas' expenditure review and approval processes already meet or exceed the recommendations above. Action Taken: Expenditure Review – All expenditures charged to grants are reviewed and approved by two qualified individuals. Documentation of Review and Approval – Such review and approval for non-payroll expenditures occur in and are documented in the SAP Concur software before the costs are recorded in the accounting system (Abila). Such review and approval for payroll-related expenditures occur via and are documented via a combination of methods, also before they are recorded in Abila. Employees report their time, including how much time was devoted to grant activities, in the ExponentHR payroll system, and their supervisors approve both the time and the allocation in that system. Programmatic measures that also support grant billing ("units") are calculated from activity documented in the athenaOne electronic health record (EHR). Payroll allocation is calculated by one person, based on the ExponentHR documentation and the units, then reviewed and imported into Abila by a second person. The unposted transactions are reviewed again before posting. Utilize System-Based Controls – In place as above. _________________________________________________________
Finding number: 2023-004 – Material Weakness in Internal Control Over Preparation, Reconciliation, and Retention of the Schedule of Expenditures of Federal Awards (SEFA) Federal Program #1 HIV Emergency Relief Project Grants: CFDA Number: 93.914 Federal Program #2 HIV Care Formula Grants): CFDA Number: 93.917 Federal Program #3: HIV Prevention Activities: CFDA Number: 93.941 Name of federal agency: U.S. Department of Health and Human Services (HHS) Name of pass-through entity: Multiple Repeat finding: No AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Criteria: Under 2 CFR §200.510(b), recipients of federal funds are required to prepare a Schedule of Expenditures of Federal Awards (SEFA) that fairly presents federal expenditures for each grant program and is derived from and supported by the entity's accounting records. Additionally, 2 CFR §200.302 requires that financial management systems adequately identify and account for federal awards to ensure accuracy and compliance with applicable federal requirements. Best practices dictate that federal expenditures should be reconciled regularly to the general ledger, and supporting documentation should be maintained to substantiate amounts reported on the SEFA. Condition: The Organization lacked adequate controls over the preparation, reconciliation, and retention of records related to the SEFA. Specifically: The SEFA incorrectly reported certain federal awards as non-federal awards. The SEFA is prepared based on amounts requested for reimbursement instead of directly based on expenditures incurred. Reconciliation schedules that tied SEFA expenditures directly back to the expenses recorded in the general ledger could not be located. Expenses recorded in the general ledger represent expenses incurred to operate the program in addition to direct grant expenditures; the Organization only requests reimbursement for direct program expenditures allowable under the program. Documentation of Excel-based reconciliations did not agree to reported monthly expenditures, indicating manual reclassification entries between program codes that were not clearly supported. Cause: The deficiencies noted were primarily due to: Lack of system controls to ensure that state and federal expenditures were separately tracked from non-grant funds spent within the same source codes. Turnover in grants management personnel, which resulted in missing, incomplete, or inaccurate reconciling records. Possible effect: Without a complete and accurate SEFA, the Organization risks noncompliance with Uniform Guidance reporting requirements, which could impact its ability to receive and administer federal funds in the future. Additionally, inaccurate SEFA reporting increases the risk of errors in administering funds, questioned costs, and over or under expenditure of grants. Questioned cost: None identified at this time. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Recommendation: We recommend that the Organization implement the following measures to improve SEFA preparation and record retention: 1. Develop a Standardized SEFA Reconciliation Process – Implement formal policies and procedures requiring that SEFA expenditures be reconciled to the general ledger on a monthly basis, with documentation maintained for audit purposes. 2. Enhance System Controls for Grant Expenditures – Modify the financial system to allow for the proper segregation of state and federal expenditures from non-grant funds, ensuring that expenditures are properly classified at the time of entry. 3. Require Monthly Documentation Reviews – Establish a control requiring management to review and approve SEFA reconciliation schedules on a monthly or quarterly basis to ensure accuracy and completeness. 4. Implement a Centralized Documentation Retention Policy – Require that all SEFA-related reconciliation records, including general ledger tie-outs and manual adjustments, be retained in a centralized, accessible location. 5. Provide Grants Management Training – Conduct training for grants management and accounting personnel on SEFA preparation requirements, including Uniform Guidance compliance and best practices for documentation and reconciliation. 6. By implementing these measures, the Organization can improve its internal controls over SEFA preparation, ensure compliance with Uniform Guidance, and reduce the risk of reporting inaccuracies. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Views of responsible officials: Management partially agrees with the finding. While we acknowledge that documentation supporting SEFA reconciliation was incomplete, we believe that federal expenditures were properly accounted for. We would like to address some of the auditors' points individually: "The SEFA is prepared based on amounts requested for reimbursement instead of directly based on expenditures incurred." Most grant awards do not fully fund the programs they support, most grant awards do not run concurrently with Prism Health North Texas' fiscal year (i.e., with the Calendar Year), and most grant awards are not spent in equal monthly amounts. It is correct that the 2023 SEFA was based on grant-appropriate expenditures that occurred during Calendar Year 2023 and were submitted to those grant sponsors for reimbursement. This will not necessarily reach the full cost to Prism for each grant-supported program, nor is it likely to exactly match any annual grant award amount. "Expenses recorded in the general ledger represent expenses incurred to operate the program in addition to direct grant expenditures; the Organization only requests reimbursement for direct program expenditures allowable under the program." As we confirmed verbally with the audit partner on April 25, 2025, this statement is intended to provide information and context and is not a criticism or intended to point out any problem. As stated above, most grant awards do not fully fund the programs they support; therefore, the general ledger necessarily includes both expenses the sponsor will reimburse and expenses the sponsor will not reimburse. Nonetheless, we are enhancing our reconciliation procedures and documentation practices to fully meet audit requirements. Finding 2023-004 refers to the auditors' assessment of the SEFA preparation and reconciliation processes that occurred in Calendar Year 2023. As of this writing, Prism Health North Texas has already changed its SEFA preparation and reconciliation processes and meets many of the recommendations above. Action Taken: Documentation Retention – On April 25, 2025, management created a structured and easily accessible system for storing all relevant information for all grants management personnel. A logical naming system for files identifying the SEFA period, the funding agency and identified general ledger expenditures claimed on the SEFA. We are now documenting the difference between all GL transactions and those submitted for sponsor reimbursement (i.e., SEFA components) in a single document per fund code, arranged by fiscal year. Previously this documentation was kept by invoice and arranged by grant year. Management will continue to ensure all expenditure-related support, such as invoices and purchase orders, is saved electronically to all AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) financial transactions. SEFA Reconciliation – Management has decided to move from an annual to quarterly SEFA reconciliation process to enhance the frequency of management oversight in SEFA draft preparation. VP of Finance will prepare the SEFA for independent review by the CFO. This will be put into a written policy/procedure. System Enhancements – Prism's current accounting system does not accommodate this. However, Prism is already in the later stages of selecting a new Enterprise Resource Planning (ERP) solution, with this as one of our key selection criteria. Our new ERP should allow for expenditures within the same cost center to be identified as grant-reimbursable or non-grant-reimbursable at the time of entry. We have identified opportunities in new financial management software solutions that we are scheduled to demo May 12th and the 16th of 2025. Opportunities such as: The ability to tag grant-reimbursable transactions, to segment our award cost center into two important categories. The full cost to manage a specific program. Identified cost claimed on the SEFA. Dedicated grant modules that will allow us to establish business rules and workflows to streamline and digitize critical aspects of grant management. Staff Engagement – Cross department coordination meetings occur monthly between the Finance organization and the Grants Management team to continue to foster alignment and collaboration in our grant cycles. A general overview of SEFA, including how to prepare and organize the monthly reconciliations, has already occurred with some of the grants accountants. _________________________________________________________
Finding number: 2023-005 Significant Deficiency in Internal Control Over Compliance: Allowable Costs and Activities Federal Program #1 HIV Emergency Relief Project Grants: CFDA Number 93.914 Federal Program #2 HIV Care Formula Grants: CFDA Number 93.917 Federal Program #3 HIV Prevention Activities: CFDA Number: 93.941 Name of federal agency: U.S. Department of Health and Human Services (HHS) Name of pass-through entity: Multiple Repeat finding: No AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Criteria: Under 2 CFR §200.303, recipients of federal funds must establish and maintain effective internal controls to ensure compliance with federal statutes, regulations, and the terms of grant agreements. 2 CFR §200.403 specifies that costs charged to federal programs must be allowable, necessary, reasonable, and allocable to the respective award. Additionally, 2 CFR §200.302 requires financial management systems to provide effective control and accountability over federal funds, including documented approval of expenditures. A best practice for grant compliance is to implement a documented approval process for expenditures charged to federal programs, ensuring that all costs are reviewed and supported by adequate documentation before reimbursement requests are submitted. Condition: The Organization did not have readily-available documented evidence of review and approval for expenditures charged to federal grants during the fiscal year. Specifically: The financial system did not capture or document approval of expenditures before they were charged to federal programs. No formalized system existed to retain evidence of grant-related expenditure reviews. While the prior Chief Financial Officer (CFO) manually reviewed each invoice, there was no indication of approval on the supporting documentation, making it impossible to verify that an appropriate review occurred before costs were charged to the grants. Cause: The issue arose due to the Organization's reliance on a manual review process conducted by the previous CFO, without requiring a formal approval signature or electronic system control to document review. This lack of a structured approval process resulted in insufficient evidence to support compliance with federal allowable cost requirements. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Possible effect: Without a documented approval process, the Organization cannot demonstrate that expenditures charged to the grants were properly reviewed for allowability, reasonableness, and allocability in accordance with federal regulations. This increases the risk that: Unallowable or misclassified expenditures could be charged to the grants without detection. Noncompliance with federal grant requirements could result in questioned costs or additional oversight from funding agencies. Financial statement and grant reporting inaccuracies may occur if expenditures are not properly reviewed and approved. Although no specific unallowable costs were identified during the audit, the lack of documented review represents a significant deficiency in internal control over compliance. Questioned cost: None identified at this time. Recommendation: We recommend that the Organization strengthen its internal controls over grant expenditures by implementing the following measures: 1. Implement a Formal Expenditure Review and Approval Policy – Establish a policy requiring that all expenditures charged to grants be reviewed and approved by an appropriate individual before being recorded in the system. 2. Require Documentation of Review and Approval – Ensure that invoices, payroll allocations, and other cost support documents include a signature, initials, or system-generated approval to confirm review. 3. Utilize System-Based Controls – If possible, configure the financial system to require electronic approval for all grant-related expenditures before costs are recorded. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Views of responsible officials: Management partially agrees with the finding. While we acknowledge that documentation of expenditure approval was not always retrievable, we believe the expenditures reviewed were all appropriate. Finding 2023-005 refers to the auditors' assessment of expenditure review and approval processes that occurred in Calendar Year 2023. During Calendar Year 2023, Prism relied on email routing of expenditures for review and approval. As of this writing, Prism Health North Texas' expenditure review and approval processes already meet or exceed the recommendations above. Action Taken: Expenditure Review – All expenditures charged to grants are reviewed and approved by two qualified individuals. Documentation of Review and Approval – Such review and approval for non-payroll expenditures occur in and are documented in the SAP Concur software before the costs are recorded in the accounting system (Abila). Such review and approval for payroll-related expenditures occur via and are documented via a combination of methods, also before they are recorded in Abila. Employees report their time, including how much time was devoted to grant activities, in the ExponentHR payroll system, and their supervisors approve both the time and the allocation in that system. Programmatic measures that also support grant billing ("units") are calculated from activity documented in the athenaOne electronic health record (EHR). Payroll allocation is calculated by one person, based on the ExponentHR documentation and the units, then reviewed and imported into Abila by a second person. The unposted transactions are reviewed again before posting. Utilize System-Based Controls – In place as above. _________________________________________________________
Finding number: 2023-004 – Material Weakness in Internal Control Over Preparation, Reconciliation, and Retention of the Schedule of Expenditures of Federal Awards (SEFA) Federal Program #1 HIV Emergency Relief Project Grants: CFDA Number: 93.914 Federal Program #2 HIV Care Formula Grants): CFDA Number: 93.917 Federal Program #3: HIV Prevention Activities: CFDA Number: 93.941 Name of federal agency: U.S. Department of Health and Human Services (HHS) Name of pass-through entity: Multiple Repeat finding: No AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Criteria: Under 2 CFR §200.510(b), recipients of federal funds are required to prepare a Schedule of Expenditures of Federal Awards (SEFA) that fairly presents federal expenditures for each grant program and is derived from and supported by the entity's accounting records. Additionally, 2 CFR §200.302 requires that financial management systems adequately identify and account for federal awards to ensure accuracy and compliance with applicable federal requirements. Best practices dictate that federal expenditures should be reconciled regularly to the general ledger, and supporting documentation should be maintained to substantiate amounts reported on the SEFA. Condition: The Organization lacked adequate controls over the preparation, reconciliation, and retention of records related to the SEFA. Specifically: The SEFA incorrectly reported certain federal awards as non-federal awards. The SEFA is prepared based on amounts requested for reimbursement instead of directly based on expenditures incurred. Reconciliation schedules that tied SEFA expenditures directly back to the expenses recorded in the general ledger could not be located. Expenses recorded in the general ledger represent expenses incurred to operate the program in addition to direct grant expenditures; the Organization only requests reimbursement for direct program expenditures allowable under the program. Documentation of Excel-based reconciliations did not agree to reported monthly expenditures, indicating manual reclassification entries between program codes that were not clearly supported. Cause: The deficiencies noted were primarily due to: Lack of system controls to ensure that state and federal expenditures were separately tracked from non-grant funds spent within the same source codes. Turnover in grants management personnel, which resulted in missing, incomplete, or inaccurate reconciling records. Possible effect: Without a complete and accurate SEFA, the Organization risks noncompliance with Uniform Guidance reporting requirements, which could impact its ability to receive and administer federal funds in the future. Additionally, inaccurate SEFA reporting increases the risk of errors in administering funds, questioned costs, and over or under expenditure of grants. Questioned cost: None identified at this time. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Recommendation: We recommend that the Organization implement the following measures to improve SEFA preparation and record retention: 1. Develop a Standardized SEFA Reconciliation Process – Implement formal policies and procedures requiring that SEFA expenditures be reconciled to the general ledger on a monthly basis, with documentation maintained for audit purposes. 2. Enhance System Controls for Grant Expenditures – Modify the financial system to allow for the proper segregation of state and federal expenditures from non-grant funds, ensuring that expenditures are properly classified at the time of entry. 3. Require Monthly Documentation Reviews – Establish a control requiring management to review and approve SEFA reconciliation schedules on a monthly or quarterly basis to ensure accuracy and completeness. 4. Implement a Centralized Documentation Retention Policy – Require that all SEFA-related reconciliation records, including general ledger tie-outs and manual adjustments, be retained in a centralized, accessible location. 5. Provide Grants Management Training – Conduct training for grants management and accounting personnel on SEFA preparation requirements, including Uniform Guidance compliance and best practices for documentation and reconciliation. 6. By implementing these measures, the Organization can improve its internal controls over SEFA preparation, ensure compliance with Uniform Guidance, and reduce the risk of reporting inaccuracies. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Views of responsible officials: Management partially agrees with the finding. While we acknowledge that documentation supporting SEFA reconciliation was incomplete, we believe that federal expenditures were properly accounted for. We would like to address some of the auditors' points individually: "The SEFA is prepared based on amounts requested for reimbursement instead of directly based on expenditures incurred." Most grant awards do not fully fund the programs they support, most grant awards do not run concurrently with Prism Health North Texas' fiscal year (i.e., with the Calendar Year), and most grant awards are not spent in equal monthly amounts. It is correct that the 2023 SEFA was based on grant-appropriate expenditures that occurred during Calendar Year 2023 and were submitted to those grant sponsors for reimbursement. This will not necessarily reach the full cost to Prism for each grant-supported program, nor is it likely to exactly match any annual grant award amount. "Expenses recorded in the general ledger represent expenses incurred to operate the program in addition to direct grant expenditures; the Organization only requests reimbursement for direct program expenditures allowable under the program." As we confirmed verbally with the audit partner on April 25, 2025, this statement is intended to provide information and context and is not a criticism or intended to point out any problem. As stated above, most grant awards do not fully fund the programs they support; therefore, the general ledger necessarily includes both expenses the sponsor will reimburse and expenses the sponsor will not reimburse. Nonetheless, we are enhancing our reconciliation procedures and documentation practices to fully meet audit requirements. Finding 2023-004 refers to the auditors' assessment of the SEFA preparation and reconciliation processes that occurred in Calendar Year 2023. As of this writing, Prism Health North Texas has already changed its SEFA preparation and reconciliation processes and meets many of the recommendations above. Action Taken: Documentation Retention – On April 25, 2025, management created a structured and easily accessible system for storing all relevant information for all grants management personnel. A logical naming system for files identifying the SEFA period, the funding agency and identified general ledger expenditures claimed on the SEFA. We are now documenting the difference between all GL transactions and those submitted for sponsor reimbursement (i.e., SEFA components) in a single document per fund code, arranged by fiscal year. Previously this documentation was kept by invoice and arranged by grant year. Management will continue to ensure all expenditure-related support, such as invoices and purchase orders, is saved electronically to all AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) financial transactions. SEFA Reconciliation – Management has decided to move from an annual to quarterly SEFA reconciliation process to enhance the frequency of management oversight in SEFA draft preparation. VP of Finance will prepare the SEFA for independent review by the CFO. This will be put into a written policy/procedure. System Enhancements – Prism's current accounting system does not accommodate this. However, Prism is already in the later stages of selecting a new Enterprise Resource Planning (ERP) solution, with this as one of our key selection criteria. Our new ERP should allow for expenditures within the same cost center to be identified as grant-reimbursable or non-grant-reimbursable at the time of entry. We have identified opportunities in new financial management software solutions that we are scheduled to demo May 12th and the 16th of 2025. Opportunities such as: The ability to tag grant-reimbursable transactions, to segment our award cost center into two important categories. The full cost to manage a specific program. Identified cost claimed on the SEFA. Dedicated grant modules that will allow us to establish business rules and workflows to streamline and digitize critical aspects of grant management. Staff Engagement – Cross department coordination meetings occur monthly between the Finance organization and the Grants Management team to continue to foster alignment and collaboration in our grant cycles. A general overview of SEFA, including how to prepare and organize the monthly reconciliations, has already occurred with some of the grants accountants. _________________________________________________________
Finding number: 2023-005 Significant Deficiency in Internal Control Over Compliance: Allowable Costs and Activities Federal Program #1 HIV Emergency Relief Project Grants: CFDA Number 93.914 Federal Program #2 HIV Care Formula Grants: CFDA Number 93.917 Federal Program #3 HIV Prevention Activities: CFDA Number: 93.941 Name of federal agency: U.S. Department of Health and Human Services (HHS) Name of pass-through entity: Multiple Repeat finding: No AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Criteria: Under 2 CFR §200.303, recipients of federal funds must establish and maintain effective internal controls to ensure compliance with federal statutes, regulations, and the terms of grant agreements. 2 CFR §200.403 specifies that costs charged to federal programs must be allowable, necessary, reasonable, and allocable to the respective award. Additionally, 2 CFR §200.302 requires financial management systems to provide effective control and accountability over federal funds, including documented approval of expenditures. A best practice for grant compliance is to implement a documented approval process for expenditures charged to federal programs, ensuring that all costs are reviewed and supported by adequate documentation before reimbursement requests are submitted. Condition: The Organization did not have readily-available documented evidence of review and approval for expenditures charged to federal grants during the fiscal year. Specifically: The financial system did not capture or document approval of expenditures before they were charged to federal programs. No formalized system existed to retain evidence of grant-related expenditure reviews. While the prior Chief Financial Officer (CFO) manually reviewed each invoice, there was no indication of approval on the supporting documentation, making it impossible to verify that an appropriate review occurred before costs were charged to the grants. Cause: The issue arose due to the Organization's reliance on a manual review process conducted by the previous CFO, without requiring a formal approval signature or electronic system control to document review. This lack of a structured approval process resulted in insufficient evidence to support compliance with federal allowable cost requirements. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Possible effect: Without a documented approval process, the Organization cannot demonstrate that expenditures charged to the grants were properly reviewed for allowability, reasonableness, and allocability in accordance with federal regulations. This increases the risk that: Unallowable or misclassified expenditures could be charged to the grants without detection. Noncompliance with federal grant requirements could result in questioned costs or additional oversight from funding agencies. Financial statement and grant reporting inaccuracies may occur if expenditures are not properly reviewed and approved. Although no specific unallowable costs were identified during the audit, the lack of documented review represents a significant deficiency in internal control over compliance. Questioned cost: None identified at this time. Recommendation: We recommend that the Organization strengthen its internal controls over grant expenditures by implementing the following measures: 1. Implement a Formal Expenditure Review and Approval Policy – Establish a policy requiring that all expenditures charged to grants be reviewed and approved by an appropriate individual before being recorded in the system. 2. Require Documentation of Review and Approval – Ensure that invoices, payroll allocations, and other cost support documents include a signature, initials, or system-generated approval to confirm review. 3. Utilize System-Based Controls – If possible, configure the financial system to require electronic approval for all grant-related expenditures before costs are recorded. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Views of responsible officials: Management partially agrees with the finding. While we acknowledge that documentation of expenditure approval was not always retrievable, we believe the expenditures reviewed were all appropriate. Finding 2023-005 refers to the auditors' assessment of expenditure review and approval processes that occurred in Calendar Year 2023. During Calendar Year 2023, Prism relied on email routing of expenditures for review and approval. As of this writing, Prism Health North Texas' expenditure review and approval processes already meet or exceed the recommendations above. Action Taken: Expenditure Review – All expenditures charged to grants are reviewed and approved by two qualified individuals. Documentation of Review and Approval – Such review and approval for non-payroll expenditures occur in and are documented in the SAP Concur software before the costs are recorded in the accounting system (Abila). Such review and approval for payroll-related expenditures occur via and are documented via a combination of methods, also before they are recorded in Abila. Employees report their time, including how much time was devoted to grant activities, in the ExponentHR payroll system, and their supervisors approve both the time and the allocation in that system. Programmatic measures that also support grant billing ("units") are calculated from activity documented in the athenaOne electronic health record (EHR). Payroll allocation is calculated by one person, based on the ExponentHR documentation and the units, then reviewed and imported into Abila by a second person. The unposted transactions are reviewed again before posting. Utilize System-Based Controls – In place as above. _________________________________________________________
Finding number: 2023-004 – Material Weakness in Internal Control Over Preparation, Reconciliation, and Retention of the Schedule of Expenditures of Federal Awards (SEFA) Federal Program #1 HIV Emergency Relief Project Grants: CFDA Number: 93.914 Federal Program #2 HIV Care Formula Grants): CFDA Number: 93.917 Federal Program #3: HIV Prevention Activities: CFDA Number: 93.941 Name of federal agency: U.S. Department of Health and Human Services (HHS) Name of pass-through entity: Multiple Repeat finding: No AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Criteria: Under 2 CFR §200.510(b), recipients of federal funds are required to prepare a Schedule of Expenditures of Federal Awards (SEFA) that fairly presents federal expenditures for each grant program and is derived from and supported by the entity's accounting records. Additionally, 2 CFR §200.302 requires that financial management systems adequately identify and account for federal awards to ensure accuracy and compliance with applicable federal requirements. Best practices dictate that federal expenditures should be reconciled regularly to the general ledger, and supporting documentation should be maintained to substantiate amounts reported on the SEFA. Condition: The Organization lacked adequate controls over the preparation, reconciliation, and retention of records related to the SEFA. Specifically: The SEFA incorrectly reported certain federal awards as non-federal awards. The SEFA is prepared based on amounts requested for reimbursement instead of directly based on expenditures incurred. Reconciliation schedules that tied SEFA expenditures directly back to the expenses recorded in the general ledger could not be located. Expenses recorded in the general ledger represent expenses incurred to operate the program in addition to direct grant expenditures; the Organization only requests reimbursement for direct program expenditures allowable under the program. Documentation of Excel-based reconciliations did not agree to reported monthly expenditures, indicating manual reclassification entries between program codes that were not clearly supported. Cause: The deficiencies noted were primarily due to: Lack of system controls to ensure that state and federal expenditures were separately tracked from non-grant funds spent within the same source codes. Turnover in grants management personnel, which resulted in missing, incomplete, or inaccurate reconciling records. Possible effect: Without a complete and accurate SEFA, the Organization risks noncompliance with Uniform Guidance reporting requirements, which could impact its ability to receive and administer federal funds in the future. Additionally, inaccurate SEFA reporting increases the risk of errors in administering funds, questioned costs, and over or under expenditure of grants. Questioned cost: None identified at this time. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Recommendation: We recommend that the Organization implement the following measures to improve SEFA preparation and record retention: 1. Develop a Standardized SEFA Reconciliation Process – Implement formal policies and procedures requiring that SEFA expenditures be reconciled to the general ledger on a monthly basis, with documentation maintained for audit purposes. 2. Enhance System Controls for Grant Expenditures – Modify the financial system to allow for the proper segregation of state and federal expenditures from non-grant funds, ensuring that expenditures are properly classified at the time of entry. 3. Require Monthly Documentation Reviews – Establish a control requiring management to review and approve SEFA reconciliation schedules on a monthly or quarterly basis to ensure accuracy and completeness. 4. Implement a Centralized Documentation Retention Policy – Require that all SEFA-related reconciliation records, including general ledger tie-outs and manual adjustments, be retained in a centralized, accessible location. 5. Provide Grants Management Training – Conduct training for grants management and accounting personnel on SEFA preparation requirements, including Uniform Guidance compliance and best practices for documentation and reconciliation. 6. By implementing these measures, the Organization can improve its internal controls over SEFA preparation, ensure compliance with Uniform Guidance, and reduce the risk of reporting inaccuracies. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Views of responsible officials: Management partially agrees with the finding. While we acknowledge that documentation supporting SEFA reconciliation was incomplete, we believe that federal expenditures were properly accounted for. We would like to address some of the auditors' points individually: "The SEFA is prepared based on amounts requested for reimbursement instead of directly based on expenditures incurred." Most grant awards do not fully fund the programs they support, most grant awards do not run concurrently with Prism Health North Texas' fiscal year (i.e., with the Calendar Year), and most grant awards are not spent in equal monthly amounts. It is correct that the 2023 SEFA was based on grant-appropriate expenditures that occurred during Calendar Year 2023 and were submitted to those grant sponsors for reimbursement. This will not necessarily reach the full cost to Prism for each grant-supported program, nor is it likely to exactly match any annual grant award amount. "Expenses recorded in the general ledger represent expenses incurred to operate the program in addition to direct grant expenditures; the Organization only requests reimbursement for direct program expenditures allowable under the program." As we confirmed verbally with the audit partner on April 25, 2025, this statement is intended to provide information and context and is not a criticism or intended to point out any problem. As stated above, most grant awards do not fully fund the programs they support; therefore, the general ledger necessarily includes both expenses the sponsor will reimburse and expenses the sponsor will not reimburse. Nonetheless, we are enhancing our reconciliation procedures and documentation practices to fully meet audit requirements. Finding 2023-004 refers to the auditors' assessment of the SEFA preparation and reconciliation processes that occurred in Calendar Year 2023. As of this writing, Prism Health North Texas has already changed its SEFA preparation and reconciliation processes and meets many of the recommendations above. Action Taken: Documentation Retention – On April 25, 2025, management created a structured and easily accessible system for storing all relevant information for all grants management personnel. A logical naming system for files identifying the SEFA period, the funding agency and identified general ledger expenditures claimed on the SEFA. We are now documenting the difference between all GL transactions and those submitted for sponsor reimbursement (i.e., SEFA components) in a single document per fund code, arranged by fiscal year. Previously this documentation was kept by invoice and arranged by grant year. Management will continue to ensure all expenditure-related support, such as invoices and purchase orders, is saved electronically to all AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) financial transactions. SEFA Reconciliation – Management has decided to move from an annual to quarterly SEFA reconciliation process to enhance the frequency of management oversight in SEFA draft preparation. VP of Finance will prepare the SEFA for independent review by the CFO. This will be put into a written policy/procedure. System Enhancements – Prism's current accounting system does not accommodate this. However, Prism is already in the later stages of selecting a new Enterprise Resource Planning (ERP) solution, with this as one of our key selection criteria. Our new ERP should allow for expenditures within the same cost center to be identified as grant-reimbursable or non-grant-reimbursable at the time of entry. We have identified opportunities in new financial management software solutions that we are scheduled to demo May 12th and the 16th of 2025. Opportunities such as: The ability to tag grant-reimbursable transactions, to segment our award cost center into two important categories. The full cost to manage a specific program. Identified cost claimed on the SEFA. Dedicated grant modules that will allow us to establish business rules and workflows to streamline and digitize critical aspects of grant management. Staff Engagement – Cross department coordination meetings occur monthly between the Finance organization and the Grants Management team to continue to foster alignment and collaboration in our grant cycles. A general overview of SEFA, including how to prepare and organize the monthly reconciliations, has already occurred with some of the grants accountants. _________________________________________________________
Finding number: 2023-005 Significant Deficiency in Internal Control Over Compliance: Allowable Costs and Activities Federal Program #1 HIV Emergency Relief Project Grants: CFDA Number 93.914 Federal Program #2 HIV Care Formula Grants: CFDA Number 93.917 Federal Program #3 HIV Prevention Activities: CFDA Number: 93.941 Name of federal agency: U.S. Department of Health and Human Services (HHS) Name of pass-through entity: Multiple Repeat finding: No AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Criteria: Under 2 CFR §200.303, recipients of federal funds must establish and maintain effective internal controls to ensure compliance with federal statutes, regulations, and the terms of grant agreements. 2 CFR §200.403 specifies that costs charged to federal programs must be allowable, necessary, reasonable, and allocable to the respective award. Additionally, 2 CFR §200.302 requires financial management systems to provide effective control and accountability over federal funds, including documented approval of expenditures. A best practice for grant compliance is to implement a documented approval process for expenditures charged to federal programs, ensuring that all costs are reviewed and supported by adequate documentation before reimbursement requests are submitted. Condition: The Organization did not have readily-available documented evidence of review and approval for expenditures charged to federal grants during the fiscal year. Specifically: The financial system did not capture or document approval of expenditures before they were charged to federal programs. No formalized system existed to retain evidence of grant-related expenditure reviews. While the prior Chief Financial Officer (CFO) manually reviewed each invoice, there was no indication of approval on the supporting documentation, making it impossible to verify that an appropriate review occurred before costs were charged to the grants. Cause: The issue arose due to the Organization's reliance on a manual review process conducted by the previous CFO, without requiring a formal approval signature or electronic system control to document review. This lack of a structured approval process resulted in insufficient evidence to support compliance with federal allowable cost requirements. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Possible effect: Without a documented approval process, the Organization cannot demonstrate that expenditures charged to the grants were properly reviewed for allowability, reasonableness, and allocability in accordance with federal regulations. This increases the risk that: Unallowable or misclassified expenditures could be charged to the grants without detection. Noncompliance with federal grant requirements could result in questioned costs or additional oversight from funding agencies. Financial statement and grant reporting inaccuracies may occur if expenditures are not properly reviewed and approved. Although no specific unallowable costs were identified during the audit, the lack of documented review represents a significant deficiency in internal control over compliance. Questioned cost: None identified at this time. Recommendation: We recommend that the Organization strengthen its internal controls over grant expenditures by implementing the following measures: 1. Implement a Formal Expenditure Review and Approval Policy – Establish a policy requiring that all expenditures charged to grants be reviewed and approved by an appropriate individual before being recorded in the system. 2. Require Documentation of Review and Approval – Ensure that invoices, payroll allocations, and other cost support documents include a signature, initials, or system-generated approval to confirm review. 3. Utilize System-Based Controls – If possible, configure the financial system to require electronic approval for all grant-related expenditures before costs are recorded. AIDS Arms, Inc. dba Prism Health North Texas and Subsidiary Schedule of Findings and Questioned Costs For the Year Ended December 31, 2023 SECTION III - SUMMARY OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (continued) Views of responsible officials: Management partially agrees with the finding. While we acknowledge that documentation of expenditure approval was not always retrievable, we believe the expenditures reviewed were all appropriate. Finding 2023-005 refers to the auditors' assessment of expenditure review and approval processes that occurred in Calendar Year 2023. During Calendar Year 2023, Prism relied on email routing of expenditures for review and approval. As of this writing, Prism Health North Texas' expenditure review and approval processes already meet or exceed the recommendations above. Action Taken: Expenditure Review – All expenditures charged to grants are reviewed and approved by two qualified individuals. Documentation of Review and Approval – Such review and approval for non-payroll expenditures occur in and are documented in the SAP Concur software before the costs are recorded in the accounting system (Abila). Such review and approval for payroll-related expenditures occur via and are documented via a combination of methods, also before they are recorded in Abila. Employees report their time, including how much time was devoted to grant activities, in the ExponentHR payroll system, and their supervisors approve both the time and the allocation in that system. Programmatic measures that also support grant billing ("units") are calculated from activity documented in the athenaOne electronic health record (EHR). Payroll allocation is calculated by one person, based on the ExponentHR documentation and the units, then reviewed and imported into Abila by a second person. The unposted transactions are reviewed again before posting. Utilize System-Based Controls – In place as above. _________________________________________________________
Uniform Guidance requires written policies for the requirements outlined in 2 CFR 200.302(b)(7), 2 CFR 200.318(c)(1), 2 CFR 200.318(c)(2), 2 CFR 200.320(b)(2), and 2 CFR 200.319(d). The Village does not have written policies in place for the requirements outlined in the Code of Federal Regulations sections referenced above.
2023-003 Internal Controls and Compliance over Allowable Costs (Significant Deficiency) U.S. Department of Health and Human Services 93.939 HIV Prevention Activities - Non-Governmental Organization Based 2022-2023 and 2023-2024 Funding Criteria: Under 2 CFR Section 200.303(a), non‐federal entities must establish and maintain effective internal controls to provide reasonable assurance that the entity is managing the federal awards in compliance with statues, regulations, and the terms and conditions of the award. Additionally, grantees are required to have a detailed breakout of these costs along with any supporting documents for those expenses for auditing and oversight. Title 2 CFR 200.302 requires the financial management system of each non-Federal entity provide records that identify adequately the source and application of funds for federally-funded activities. Condition: We noted instances of the allocation rates being used to calculate amount of payroll costs to charge to grants did not agree to the hours incurred per approved timesheets. SECTION III – FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Cause: The personnel costs charged to the grant were not reconciled to timesheets correctly by the accounting personnel. Effect: AIH requested in error reimbursement for unallowable payroll costs. Questioned Costs: $42 Perspective: Allocation errors were noted for 2 employees in 3 payroll periods tested. Repeat Finding: No Auditor’s Recommendation: Review process should be reevaluated and employees retrained to ensure that only actual hours worked from timesheets are charged to grant. Views of Responsible Officials: We concur with the recommendation, please see Corrective Action Plan.
2023-003 Internal Controls and Compliance over Allowable Costs (Significant Deficiency) U.S. Department of Health and Human Services 93.939 HIV Prevention Activities - Non-Governmental Organization Based 2022-2023 and 2023-2024 Funding Criteria: Under 2 CFR Section 200.303(a), non‐federal entities must establish and maintain effective internal controls to provide reasonable assurance that the entity is managing the federal awards in compliance with statues, regulations, and the terms and conditions of the award. Additionally, grantees are required to have a detailed breakout of these costs along with any supporting documents for those expenses for auditing and oversight. Title 2 CFR 200.302 requires the financial management system of each non-Federal entity provide records that identify adequately the source and application of funds for federally-funded activities. Condition: We noted instances of the allocation rates being used to calculate amount of payroll costs to charge to grants did not agree to the hours incurred per approved timesheets. SECTION III – FEDERAL AWARD FINDINGS AND QUESTIONED COSTS (Continued) Cause: The personnel costs charged to the grant were not reconciled to timesheets correctly by the accounting personnel. Effect: AIH requested in error reimbursement for unallowable payroll costs. Questioned Costs: $42 Perspective: Allocation errors were noted for 2 employees in 3 payroll periods tested. Repeat Finding: No Auditor’s Recommendation: Review process should be reevaluated and employees retrained to ensure that only actual hours worked from timesheets are charged to grant. Views of Responsible Officials: We concur with the recommendation, please see Corrective Action Plan.
2023-001 Implement System-Based Tracking of Federal Expenditures Assistance Listing Number: 93.566 Assistance Listing Program Title: Refugee and Entrant Assistance – State - Administered Programs Federal Agency: Department of Health and Human Services (HHS) Passed Through Entities: 1. California Department of Social Services 2. University of California, San Diego 3. California Rural Legal Assistance Foundation 4. San Diego Refugee Communities Coalition/United Women of East Africa Support Team Federal Award Numbers: ALSP22-0002-A1, PUR00533092, ALSP22-0001, and ACS22-05-CAIR-A1 Federal Award Year: 8/1/2022 to 3/31/2025 Compliance Requirement: Activities Allowed or Unallowed Criteria: Management is responsible for designing, implementing, and maintaining an internal control system that ensures accurate financial reporting. Effective internal control over financial reporting provides reasonable assurance regarding the completeness and accuracy of accounting records, and compliance with grantor requirements. 2 CFR 200.510 Financial Statements require auditees to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee's financial statements. This schedule must include the total Federal awards expended, as determined in accordance with 2 CFR 200.502. The information presented should be consistent with the accounting records (i.e., general ledger). In addition, Section 2 CFR 200.302(b)(1) provides that non-Federal entities must maintain effective control over and accountability for all funds, and must identify, in their accounts, all Federal awards received and expended. Condition: During our review of the SEFA, we noted that CAIR-CA currently utilizes workbooks outside of its accounting software to track federal expenditures. The external workbooks do not reconcile directly with the general ledger (GL) requiring management to prepare a separate reconciliation to support the SEFA amounts. Cause: This year marks CAIR-CA’s first Single Audit. As such, processes and internal controls over federal award tracking are still under development. The current system is not yet fully integrated to allow for automated or system-based tracking of federal expenditures by grant. Effect: Relying on manual workbooks to track federal expenditures can be inefficient and may result in inaccurate or incomplete reporting of federal expenditures. Questioned Cost: None Recommendation: We recommend that CAIR-CA enhance its accounting processes to enable the tracking of federal expenditures directly within its accounting software. This can be accomplished by implementing GL tracking codes or tags specifically designated for federal expenditures. Transitioning to a system based tracking approach will support consistency between the general ledger and the SEFA, simplify the process of generating financial reports, and improve the tracking of federal expenditures. Views of Responsible Officials and Corrective Action Plan: Management concurs with the finding and is currently in the process of updating the accounting system to incorporate grant-specific specific tracking codes to further align with federal reporting standards. As part of a layered approach to internal controls, Excel worksheets will continue to be used as a supplementary monitoring tool, providing an additional cross-check to the system-generated reports. Responsible person: Jackie Ramirez, Operations & Finance Associate Director Expected Implementation date: November 20, 2025
2023-001 Implement System-Based Tracking of Federal Expenditures Assistance Listing Number: 93.566 Assistance Listing Program Title: Refugee and Entrant Assistance – State - Administered Programs Federal Agency: Department of Health and Human Services (HHS) Passed Through Entities: 1. California Department of Social Services 2. University of California, San Diego 3. California Rural Legal Assistance Foundation 4. San Diego Refugee Communities Coalition/United Women of East Africa Support Team Federal Award Numbers: ALSP22-0002-A1, PUR00533092, ALSP22-0001, and ACS22-05-CAIR-A1 Federal Award Year: 8/1/2022 to 3/31/2025 Compliance Requirement: Activities Allowed or Unallowed Criteria: Management is responsible for designing, implementing, and maintaining an internal control system that ensures accurate financial reporting. Effective internal control over financial reporting provides reasonable assurance regarding the completeness and accuracy of accounting records, and compliance with grantor requirements. 2 CFR 200.510 Financial Statements require auditees to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee's financial statements. This schedule must include the total Federal awards expended, as determined in accordance with 2 CFR 200.502. The information presented should be consistent with the accounting records (i.e., general ledger). In addition, Section 2 CFR 200.302(b)(1) provides that non-Federal entities must maintain effective control over and accountability for all funds, and must identify, in their accounts, all Federal awards received and expended. Condition: During our review of the SEFA, we noted that CAIR-CA currently utilizes workbooks outside of its accounting software to track federal expenditures. The external workbooks do not reconcile directly with the general ledger (GL) requiring management to prepare a separate reconciliation to support the SEFA amounts. Cause: This year marks CAIR-CA’s first Single Audit. As such, processes and internal controls over federal award tracking are still under development. The current system is not yet fully integrated to allow for automated or system-based tracking of federal expenditures by grant. Effect: Relying on manual workbooks to track federal expenditures can be inefficient and may result in inaccurate or incomplete reporting of federal expenditures. Questioned Cost: None Recommendation: We recommend that CAIR-CA enhance its accounting processes to enable the tracking of federal expenditures directly within its accounting software. This can be accomplished by implementing GL tracking codes or tags specifically designated for federal expenditures. Transitioning to a system based tracking approach will support consistency between the general ledger and the SEFA, simplify the process of generating financial reports, and improve the tracking of federal expenditures. Views of Responsible Officials and Corrective Action Plan: Management concurs with the finding and is currently in the process of updating the accounting system to incorporate grant-specific specific tracking codes to further align with federal reporting standards. As part of a layered approach to internal controls, Excel worksheets will continue to be used as a supplementary monitoring tool, providing an additional cross-check to the system-generated reports. Responsible person: Jackie Ramirez, Operations & Finance Associate Director Expected Implementation date: November 20, 2025
2023-001 Implement System-Based Tracking of Federal Expenditures Assistance Listing Number: 93.566 Assistance Listing Program Title: Refugee and Entrant Assistance – State - Administered Programs Federal Agency: Department of Health and Human Services (HHS) Passed Through Entities: 1. California Department of Social Services 2. University of California, San Diego 3. California Rural Legal Assistance Foundation 4. San Diego Refugee Communities Coalition/United Women of East Africa Support Team Federal Award Numbers: ALSP22-0002-A1, PUR00533092, ALSP22-0001, and ACS22-05-CAIR-A1 Federal Award Year: 8/1/2022 to 3/31/2025 Compliance Requirement: Activities Allowed or Unallowed Criteria: Management is responsible for designing, implementing, and maintaining an internal control system that ensures accurate financial reporting. Effective internal control over financial reporting provides reasonable assurance regarding the completeness and accuracy of accounting records, and compliance with grantor requirements. 2 CFR 200.510 Financial Statements require auditees to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee's financial statements. This schedule must include the total Federal awards expended, as determined in accordance with 2 CFR 200.502. The information presented should be consistent with the accounting records (i.e., general ledger). In addition, Section 2 CFR 200.302(b)(1) provides that non-Federal entities must maintain effective control over and accountability for all funds, and must identify, in their accounts, all Federal awards received and expended. Condition: During our review of the SEFA, we noted that CAIR-CA currently utilizes workbooks outside of its accounting software to track federal expenditures. The external workbooks do not reconcile directly with the general ledger (GL) requiring management to prepare a separate reconciliation to support the SEFA amounts. Cause: This year marks CAIR-CA’s first Single Audit. As such, processes and internal controls over federal award tracking are still under development. The current system is not yet fully integrated to allow for automated or system-based tracking of federal expenditures by grant. Effect: Relying on manual workbooks to track federal expenditures can be inefficient and may result in inaccurate or incomplete reporting of federal expenditures. Questioned Cost: None Recommendation: We recommend that CAIR-CA enhance its accounting processes to enable the tracking of federal expenditures directly within its accounting software. This can be accomplished by implementing GL tracking codes or tags specifically designated for federal expenditures. Transitioning to a system based tracking approach will support consistency between the general ledger and the SEFA, simplify the process of generating financial reports, and improve the tracking of federal expenditures. Views of Responsible Officials and Corrective Action Plan: Management concurs with the finding and is currently in the process of updating the accounting system to incorporate grant-specific specific tracking codes to further align with federal reporting standards. As part of a layered approach to internal controls, Excel worksheets will continue to be used as a supplementary monitoring tool, providing an additional cross-check to the system-generated reports. Responsible person: Jackie Ramirez, Operations & Finance Associate Director Expected Implementation date: November 20, 2025
2023-001 Implement System-Based Tracking of Federal Expenditures Assistance Listing Number: 93.566 Assistance Listing Program Title: Refugee and Entrant Assistance – State - Administered Programs Federal Agency: Department of Health and Human Services (HHS) Passed Through Entities: 1. California Department of Social Services 2. University of California, San Diego 3. California Rural Legal Assistance Foundation 4. San Diego Refugee Communities Coalition/United Women of East Africa Support Team Federal Award Numbers: ALSP22-0002-A1, PUR00533092, ALSP22-0001, and ACS22-05-CAIR-A1 Federal Award Year: 8/1/2022 to 3/31/2025 Compliance Requirement: Activities Allowed or Unallowed Criteria: Management is responsible for designing, implementing, and maintaining an internal control system that ensures accurate financial reporting. Effective internal control over financial reporting provides reasonable assurance regarding the completeness and accuracy of accounting records, and compliance with grantor requirements. 2 CFR 200.510 Financial Statements require auditees to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee's financial statements. This schedule must include the total Federal awards expended, as determined in accordance with 2 CFR 200.502. The information presented should be consistent with the accounting records (i.e., general ledger). In addition, Section 2 CFR 200.302(b)(1) provides that non-Federal entities must maintain effective control over and accountability for all funds, and must identify, in their accounts, all Federal awards received and expended. Condition: During our review of the SEFA, we noted that CAIR-CA currently utilizes workbooks outside of its accounting software to track federal expenditures. The external workbooks do not reconcile directly with the general ledger (GL) requiring management to prepare a separate reconciliation to support the SEFA amounts. Cause: This year marks CAIR-CA’s first Single Audit. As such, processes and internal controls over federal award tracking are still under development. The current system is not yet fully integrated to allow for automated or system-based tracking of federal expenditures by grant. Effect: Relying on manual workbooks to track federal expenditures can be inefficient and may result in inaccurate or incomplete reporting of federal expenditures. Questioned Cost: None Recommendation: We recommend that CAIR-CA enhance its accounting processes to enable the tracking of federal expenditures directly within its accounting software. This can be accomplished by implementing GL tracking codes or tags specifically designated for federal expenditures. Transitioning to a system based tracking approach will support consistency between the general ledger and the SEFA, simplify the process of generating financial reports, and improve the tracking of federal expenditures. Views of Responsible Officials and Corrective Action Plan: Management concurs with the finding and is currently in the process of updating the accounting system to incorporate grant-specific specific tracking codes to further align with federal reporting standards. As part of a layered approach to internal controls, Excel worksheets will continue to be used as a supplementary monitoring tool, providing an additional cross-check to the system-generated reports. Responsible person: Jackie Ramirez, Operations & Finance Associate Director Expected Implementation date: November 20, 2025
2023-001 Implement System-Based Tracking of Federal Expenditures Assistance Listing Number: 93.566 Assistance Listing Program Title: Refugee and Entrant Assistance – State - Administered Programs Federal Agency: Department of Health and Human Services (HHS) Passed Through Entities: 1. California Department of Social Services 2. University of California, San Diego 3. California Rural Legal Assistance Foundation 4. San Diego Refugee Communities Coalition/United Women of East Africa Support Team Federal Award Numbers: ALSP22-0002-A1, PUR00533092, ALSP22-0001, and ACS22-05-CAIR-A1 Federal Award Year: 8/1/2022 to 3/31/2025 Compliance Requirement: Activities Allowed or Unallowed Criteria: Management is responsible for designing, implementing, and maintaining an internal control system that ensures accurate financial reporting. Effective internal control over financial reporting provides reasonable assurance regarding the completeness and accuracy of accounting records, and compliance with grantor requirements. 2 CFR 200.510 Financial Statements require auditees to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee's financial statements. This schedule must include the total Federal awards expended, as determined in accordance with 2 CFR 200.502. The information presented should be consistent with the accounting records (i.e., general ledger). In addition, Section 2 CFR 200.302(b)(1) provides that non-Federal entities must maintain effective control over and accountability for all funds, and must identify, in their accounts, all Federal awards received and expended. Condition: During our review of the SEFA, we noted that CAIR-CA currently utilizes workbooks outside of its accounting software to track federal expenditures. The external workbooks do not reconcile directly with the general ledger (GL) requiring management to prepare a separate reconciliation to support the SEFA amounts. Cause: This year marks CAIR-CA’s first Single Audit. As such, processes and internal controls over federal award tracking are still under development. The current system is not yet fully integrated to allow for automated or system-based tracking of federal expenditures by grant. Effect: Relying on manual workbooks to track federal expenditures can be inefficient and may result in inaccurate or incomplete reporting of federal expenditures. Questioned Cost: None Recommendation: We recommend that CAIR-CA enhance its accounting processes to enable the tracking of federal expenditures directly within its accounting software. This can be accomplished by implementing GL tracking codes or tags specifically designated for federal expenditures. Transitioning to a system based tracking approach will support consistency between the general ledger and the SEFA, simplify the process of generating financial reports, and improve the tracking of federal expenditures. Views of Responsible Officials and Corrective Action Plan: Management concurs with the finding and is currently in the process of updating the accounting system to incorporate grant-specific specific tracking codes to further align with federal reporting standards. As part of a layered approach to internal controls, Excel worksheets will continue to be used as a supplementary monitoring tool, providing an additional cross-check to the system-generated reports. Responsible person: Jackie Ramirez, Operations & Finance Associate Director Expected Implementation date: November 20, 2025
2023-001 Implement System-Based Tracking of Federal Expenditures Assistance Listing Number: 93.566 Assistance Listing Program Title: Refugee and Entrant Assistance – State - Administered Programs Federal Agency: Department of Health and Human Services (HHS) Passed Through Entities: 1. California Department of Social Services 2. University of California, San Diego 3. California Rural Legal Assistance Foundation 4. San Diego Refugee Communities Coalition/United Women of East Africa Support Team Federal Award Numbers: ALSP22-0002-A1, PUR00533092, ALSP22-0001, and ACS22-05-CAIR-A1 Federal Award Year: 8/1/2022 to 3/31/2025 Compliance Requirement: Activities Allowed or Unallowed Criteria: Management is responsible for designing, implementing, and maintaining an internal control system that ensures accurate financial reporting. Effective internal control over financial reporting provides reasonable assurance regarding the completeness and accuracy of accounting records, and compliance with grantor requirements. 2 CFR 200.510 Financial Statements require auditees to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee's financial statements. This schedule must include the total Federal awards expended, as determined in accordance with 2 CFR 200.502. The information presented should be consistent with the accounting records (i.e., general ledger). In addition, Section 2 CFR 200.302(b)(1) provides that non-Federal entities must maintain effective control over and accountability for all funds, and must identify, in their accounts, all Federal awards received and expended. Condition: During our review of the SEFA, we noted that CAIR-CA currently utilizes workbooks outside of its accounting software to track federal expenditures. The external workbooks do not reconcile directly with the general ledger (GL) requiring management to prepare a separate reconciliation to support the SEFA amounts. Cause: This year marks CAIR-CA’s first Single Audit. As such, processes and internal controls over federal award tracking are still under development. The current system is not yet fully integrated to allow for automated or system-based tracking of federal expenditures by grant. Effect: Relying on manual workbooks to track federal expenditures can be inefficient and may result in inaccurate or incomplete reporting of federal expenditures. Questioned Cost: None Recommendation: We recommend that CAIR-CA enhance its accounting processes to enable the tracking of federal expenditures directly within its accounting software. This can be accomplished by implementing GL tracking codes or tags specifically designated for federal expenditures. Transitioning to a system based tracking approach will support consistency between the general ledger and the SEFA, simplify the process of generating financial reports, and improve the tracking of federal expenditures. Views of Responsible Officials and Corrective Action Plan: Management concurs with the finding and is currently in the process of updating the accounting system to incorporate grant-specific specific tracking codes to further align with federal reporting standards. As part of a layered approach to internal controls, Excel worksheets will continue to be used as a supplementary monitoring tool, providing an additional cross-check to the system-generated reports. Responsible person: Jackie Ramirez, Operations & Finance Associate Director Expected Implementation date: November 20, 2025
2 CFR 200 outlines the following policies required for a County spending Coronavirus State and Local Fiscal Recovery Funds: • 2 CFR 200.302(b)(7) for determining the allowability of costs in accordance with Subpart E-Cost Principles; • 2 CFR 200.430 for allowability of compensation costs; 2 CFR 200.464(a)(2) for reimbursement of relocation costs; • 2 CFR 200.318(c)(1) for employee conflicts of interest; • 2 CFR 200.318(c)(2) for organizational conflicts of interest; • 2 CFR 200.320(b)(2) for selection and awarding of contracts for competitive proposals; • 2 CFR 200.319(d) for minimum evaluation criteria for bids and proposals. During testing we noted that the County did not have sufficient written policies addressing the above requirements. Failure to adopt and implement policies could lead to noncompliance with federal requirements. We recommend the County approve and implement the above policies to ensure compliance with federal requirements.
2 CFR 200 outlines the following policies required for a County spending Coronavirus State and Local Fiscal Recovery Funds: • 2 CFR 200.302(b)(7) for determining the allowability of costs in accordance with Subpart E-Cost Principles; • 2 CFR 200.430 for allowability of compensation costs; 2 CFR 200.464(a)(2) for reimbursement of relocation costs; • 2 CFR 200.318(c)(1) for employee conflicts of interest; • 2 CFR 200.318(c)(2) for organizational conflicts of interest; • 2 CFR 200.320(b)(2) for selection and awarding of contracts for competitive proposals; • 2 CFR 200.319(d) for minimum evaluation criteria for bids and proposals. During testing we noted that the County did not have sufficient written policies addressing the above requirements. Failure to adopt and implement policies could lead to noncompliance with federal requirements. We recommend the County approve and implement the above policies to ensure compliance with federal requirements.
2 CFR 200 outlines the following policies required for a County spending Coronavirus State and Local Fiscal Recovery Funds: • 2 CFR 200.302(b)(7) for determining the allowability of costs in accordance with Subpart E-Cost Principles; • 2 CFR 200.430 for allowability of compensation costs; 2 CFR 200.464(a)(2) for reimbursement of relocation costs; • 2 CFR 200.318(c)(1) for employee conflicts of interest; • 2 CFR 200.318(c)(2) for organizational conflicts of interest; • 2 CFR 200.320(b)(2) for selection and awarding of contracts for competitive proposals; • 2 CFR 200.319(d) for minimum evaluation criteria for bids and proposals. During testing we noted that the County did not have sufficient written policies addressing the above requirements. Failure to adopt and implement policies could lead to noncompliance with federal requirements. We recommend the County approve and implement the above policies to ensure compliance with federal requirements.
2 CFR 200 outlines the following policies required for a County spending Coronavirus State and Local Fiscal Recovery Funds: • 2 CFR 200.302(b)(7) for determining the allowability of costs in accordance with Subpart E-Cost Principles; • 2 CFR 200.430 for allowability of compensation costs; 2 CFR 200.464(a)(2) for reimbursement of relocation costs; • 2 CFR 200.318(c)(1) for employee conflicts of interest; • 2 CFR 200.318(c)(2) for organizational conflicts of interest; • 2 CFR 200.320(b)(2) for selection and awarding of contracts for competitive proposals; • 2 CFR 200.319(d) for minimum evaluation criteria for bids and proposals. During testing we noted that the County did not have sufficient written policies addressing the above requirements. Failure to adopt and implement policies could lead to noncompliance with federal requirements. We recommend the County approve and implement the above policies to ensure compliance with federal requirements.
CONDITION: During our testing of federal expenditures, we selected a sample of 25 transactions. For eight of these transactions, totaling $1,767, the PALM could not provide the original or reconstructed vendor receipts. The payments were supported only by credit card statements, which did not include a detailed description of the goods or services purchased. CRITERIA: The PALM is required by federal grant guidelines, specifically 2 CFR 200.302, to maintain records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. CAUSE: The primary cause is a breakdown in the PALM’s internal controls over procurement and record-keeping. The lack of a consistent process to ensure all staff members who make purchases submit timely and complete receipts has created a weakness that could lead to unallowable costs being charged to the federal award. EFFECT: The lack of supporting documentation prevents the auditor from determining if the costs were necessary, reasonable, and for the exclusive purpose of the federal award. This also increases the risk of fraud, waste, and abuse. The grantee is at risk of having these costs disallowed and potentially required to repay the federal agency for the undocumented expenditures. RECOMMENDATION: We recommend that management implement a more robust internal control system to ensure all federal expenditures are supported by proper documentation. This includes: •Mandating that all employees submit itemized receipts for purchases made on federal awards. •Creating a "Missing Receipt" form that requires a detailed explanation and supervisory approval when an original receipt cannot be located. •Providing mandatory training for staff on proper procurement and documentation procedures. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTION: The PALM believes the expenses referred to were indeed for allowable costs for the federal program. They will start to maintain all proper source documentation regardless of dollar amount. QUESTIONED COSTS: A total of $1,767 is being questioned for eight transactions lacking adequate documentation.
FINDING 2023-003 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): IN0263 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-004. Condition and Context Prior to receipt of direct State and Local Fiscal Recovery Funds (SLFRF) award funds, all eligible entities were required to execute a Financial Assistance Agreement (Agreement), which included the award terms and conditions that recipients must comply with in carrying out the objectives of their award. Per the Agreement, the City was responsible for the effective administration of the federal award, as well as the application of sound management practices and administration of federal funds in a manner consistent with program objectives and terms and conditions of the award. Activities Allowed or Unallowed, Allowable Costs/Cost Principles As part of sound management of the federal award, the City was responsible for implementing a system of internal controls that would ensure compliance with the applicable requirements. The City had not properly designed or implemented such a system. There was no evidence of segregation of duties, such as an oversight, review, or approval process related to these expenditures that would have ensured that expenditures of award funds were made only for activities and costs that were allowable under the federal award and federal regulations. The City passed Ordinance 2022-45 approving a "commitment of up to but not to exceed $400,000 for Infrastructure at the Junction." However, the City made no formal agreements for the payment of claims in relation to the "Junction" Project. Of the ten claims paid with SLFRF funds during 2023, two claims totaling $400,000 were for the "Junction" project. Both claims were paid without itemized invoices and adequate supporting documentation to support amounts paid. INDIANA STATE BOARD OF ACCOUNTS 19 CITY OF LOGANSPORT SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Additionally, the City did not ensure a proper system of internal controls was in place to accurately track expenditures for the SLFRF grant. In 2022, $2.5 million of SLFRF grant funds were transferred out of the City's SLFRF fund into the City of Logansport Project Fund at a financial institution in the name of the City (bank account) and were subsequently comingled with other nonfederal funds as part of a Build Operate Transfer (BOT) Agreement. Of this $2.5 million, $1,626,043 was spent during 2022, leaving $873,957 of the original $2.5 million to be spent in 2023. During 2023, the City disbursed $4,369,454 from its BOT bank account, where SLFRF and other funding sources were comingled without tracking which expenditures were expressly for the purpose of SLFRF. It was not possible to obtain a population of federal expenditures for the BOT expenditures due to this comingling; therefore, a portion of the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements could not be tested. Costs totaling $1,273,957 were not properly documented and were considered questioned costs. The lack of internal controls and noncompliance was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302 states in part: "(a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (b) The financial management system of each non-Federal entity must provide for the following . . . (1) Identification, in its accounts, of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number and year, name of the Federal agency, and name of the pass-through entity, if any. INDIANA STATE BOARD OF ACCOUNTS 20 CITY OF LOGANSPORT SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. (4) Effective control over, and accountability for, all funds, property, and other assets. . . ." 2 CFR 200.400 states in part: "The application of these cost principles is based on the fundamental premises that: (a) The non-Federal entity is responsible for the efficient and effective administration of the Federal award through the application of sound management practices. (b) The non-Federal entity assumes responsibility for administering Federal funds in a manner consistent with underlying agreements, program objectives, and the terms and conditions of the Federal award. (c) The non-Federal entity, in recognition of its own unique combination of staff, facilities, and experience, has the primary responsibility for employing whatever form of sound organization and management techniques may be necessary in order to assure proper and efficient administration of the Federal award. . . ." 2 CFR 200.403(g) states in part: "Be adequately documented. . . ." 2 CFR 200.404 states in part: "A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person under the circumstances prevailing at the time the decision was made to incur the cost. The question of reasonableness is particularly important when the non- Federal entity is predominantly federally-funded. In determining reasonableness of a given cost, consideration must be given to: . . . (e) Whether the non-Federal entity significantly deviates from its established practices and policies regarding the incurrence of costs, which may unjustifiably increase the Federal award's cost." Cause Due to the lack of internal controls, the City was unable to differentiate expenditures made from federal and nonfederal funds once it commingled nonfederal funds and federal grant awards in a single bank account. Additionally, the City did not obtain appropriate supporting documentation for federal expenditures. INDIANA STATE BOARD OF ACCOUNTS 21 CITY OF LOGANSPORT SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect The City was unable to identify all the expenditures paid with federal funds and cannot ensure, nor can we determine, expenditures of the grant were not unallowable and adhered to established practices and polices. This could result in the misuse of funds and the potential loss of funding for future federal awards. Questioned Costs We identified $1,273,957 in known questioned costs as noted above in the Condition and Context. Recommendation We recommended that management of the City establish a system of internal controls to ensure that grant award funds are accounted for and tracked in a designated grant fund. All activity of the grant should be in this fund with supporting documentation for each transaction. Additionally, the City should obtain appropriate supporting documentation for all federal grant expenditures. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
Material Weakness Reporting Criteria and Condition: While the Organization has some written financial management procedures documentation, it does not meet all the recent specific requirements under 2 CFR 200.302 in the Uniform Grant Guidance. Context: The financial management requirements under 2 CFR 200.302 require each non-federal entity maintain effective control over, and accountability for all funds, property, and other assets, including having written procedures in place. Key changes which effect the Organization include: Increased documentation, time and effort reporting for payroll, and specific purchasing consideration. Cause: The Borough did not implement adequate controls to ensure compliance with this reporting requirement. Potential Effect: Errors could occur in financial reporting. Recommendation: We recommend the Organization update its existing policies to comply with the requirements under 2 CFR 200.302. Views of Responsible Officials and Planned Corrective Actions: Management understands the importance of defining and following the necessary policies and procedures to remain in compliance with the requirements under 2 CFR 200.302. Borough of Collegeville will implement these policies and procedures to ensure that the organization will comply going forward.
Finding 2023-001, Expense Allocations - Financial Management (Assistance Listings 93.567 and 93.576) Criteria: Per 2 CFR § 200.302(a) (Financial Management), all recipient and subrecipient financial management systems must be sufficient to track expenditures and establish that funds have been used in accordance with federal statutes, regulations, and the terms and conditions of the federal award. Condition and Context: The Organization’s documentation related to reconciliation of government grant revenue claimed and received to the actual revenue earned were not maintained. The lack of regular reconciliations increased the risk of misstatements in the financial records and delayed the financial reporting process. Cause: Internal controls over government grant revenue were not operating efficiently or designed properly. Effect: This resulted to significant amount of time required by both Management and the Auditors in order to analyze and adjust grant revenue, accounts receivables and deferred revenue balances accurately. Identification as a Repeat Finding: No. Questioned Costs: None. Recommendation: We recommend that the Organization strengthen its policies and procedures for reconciling the grant revenue earned to the related expenses. Financial reports and claims should be created from the reconciled general ledger. Additionally, management should establish clear documentation procedures to support the proper allocation of expenses in the general ledger and ensure compliance with federal regulations.
Information on the Federal Program Federal Agency: U.S. Department of Environmental Protection Agency Federal Program: Capitalization Grants for Clean Water State Revolving Funds (CWSRF) Cluster Assistance Listing Number (ALN): 66.458 Award Number: S340640-26/29/30/36/33 Award Year: 2022 and 2023 Pass-through Entity: New Jersey Department of Environmental Protection Criteria or Specific Requirement Per 2 CFR §200.302(b)(1) and (3), non-federal entities must maintain records that identify the source and application of federal funds and must provide accurate, current, and complete disclosure of financial results for each federal award. Proper accounting for grant revenues and expenditures is essential for compliance with federal reporting and cost principles. Condition During our audit of federal grant activity, we noted that certain federal grant awards were not recorded in the Authority’s general ledger. Additionally, expenditures related to these grants were not posted to grant-specific accounts but were instead recorded in general expense accounts, making it difficult to track and reconcile grant activity. Questioned Costs None noted at this time. However, due to the lack of proper tracking, the full extent of potential questioned costs could not be determined. Context During the audit, it was noted that grant awards were not recorded in the general ledger and grant expenditures were not posted to grant-specific accounts. The sample was not statistically valid. Effect or Potential Effect Failure to record grant awards and expenditures accurately may result in (1) inaccurate financial reporting to federal agencies; (2) inaccurate reporting on the Schedule of Expenditures of Federal Awards; and (3) potential noncompliance with grant terms and federal audit requirements. Cause The Authority did not have adequate procedures in place to ensure that all federal grant awards were promptly recorded in the general ledger and that expenditures were tracked using grant-specific accounts. Identification as a Repeat Finding Not applicable. Recommendation We recommend that the Authority, (1) implement procedures to ensure all federal grant awards are recorded in the general ledger upon receipt; (2) establish and use grant-specific accounts to track all related expenditures; (3) conduct periodic reconciliations between grant award letters, project expenditures, and general ledger postings; and (4) provide training to accounting personnel on federal grant accounting, compliance and reporting requirements. View of Responsible Officials and Planned Corrective Action The responsible officials agree with the finding and will address the matter as part of their corrective action plan.
Criteria: Under the Uniform Guidance, specifically 2 CFR 200.430, charges to Federal awards for compensation must be supported by a system of internal control which provides reasonable assurance that costs are allocated appropriately and accurately. Per 2 CFR §200.403, allowable costs must be "necessary, reasonable, and adequately documented." Additionally, 2 CFR §200.302(b)(3) requires non-Federal entities to maintain records that sufficiently detail financial transactions to support Federal expenditures. Condition: During our testing of payments charged to the federal major program, we noted that employee timesheets lacked evidence of review and approval. Certain employees charged to the grant did not prepare timesheets and a separate tracking system was used. Federal regulations require that expenditures charged to Federal awards be properly reviewed, approved, and documented to ensure allowability and compliance with grant terms. Cause: The Federal program was new to the organization and controls over the program had not been fully established. Turnover in the accounting department contributed to the lack of resources for tracking these costs. Effect or potential effect: Management provided documentation on personnel costs allocated to the program, but was unable to provide evidence of review. Lack of review increases the risk of unauthorized or unallowable costs being charged to the Federal award, potentially leading to questioned costs and noncompliance with Federal grant requirements. Context: This issue applied to less than 10% of the grant expenditures, $54,505 out of the $897,736 of total expenditures charged to the grant. Recommendation: Management should review the requirements of CFR 200.430 and ensure that current processes, whether digital or hard-copy driven, are consistent with the requirements of the Uniform Guidance. In addition, management should consider adding additional staff to its accounting and/or grants management team. Views of responsible officials: Management will evaluate systems and processes to ensure time tracking procedures meet the standards outlined in the Uniform Guidance.
Finding 2023-001 - U.S. Department of Housing and Urban Development, Mortgage Insurance Rental and Cooperative Housing for Moderate Income Families and Elderly, Market Interest Rate, ALN #14.135 Statement of Condition: Internal control processes over financial accounting did not ensure that all transactions were properly recorded. Internal control processes over financial accounting did not ensure that key accounts were reconciled or reviewed on a periodic basis. Criteria: The HUD Handbook 4370.2 REV-1, Chapter 2 requires the books and accounts to be complete and accurate. HUD Handbook 4370.2 REV-1, Chapter 2, Section 12 requires monthly reconciliations of all cash accounts. Additionally, 2 CFR Part 200 Section 200.302 Financial Management states that the financial management system of each non-federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award in accordance with the reporting requirements. Additionally, 2 CFR Part 200 Section 200.303(a), Internal Controls, requires that non-federal entities must establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the award in compliance with federal statutes, regulations and the terms and conditions. Effect: Noncompliance with HUD and Uniform Guidance requirements and the possibility of undetected material misstatements and/or undetected misappropriation of assets. Cause: Prior management oversight. Context: An understanding of processes and internal controls was performed with the Corporation's management and tests were performed to determine if the processes and internal controls were implemented and effective. As part of this process we noted the following processes and internal controls were not effective and/or implemented. 1) Only two of the six bank accounts were reconciled. The outsourced bookkeeper only performed a bank reconciliation for the operating and security deposit cash accounts. 2) The accounts receivable, tenants and accounts receivable, HUD were not reconciled. 3) The monthly review process of the Corporation's financial information is not fully supported by evidence of such review. Questioned Costs: N/A Recommendation: We recommend management review/enhance its accounting and internal control procedures to ensure that all key accounts are reconciled and reviewed with supporting evidence of such review. Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding and will review the accounting and financial procedures, system of internal controls and policies. The Corporation has executed a new management agreement with Remnant Management Inc. effective October 1, 2024. Remnant Management Inc. will ensure that all transactions are properly recorded and that key accounts are reconciled and reviewed on a periodic basis beginning October 1, 2024 and going forward.
COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) – Federal Assistance Listing Number 20.027 Condition: We noted one disbursement of grant funds supported by a claim form with only one source of approval. Another disbursement was supported by a claim form with only one source of approval and the check issued was signed by only one authorized signer. Criteria: 2 CFR 200.303(a) states the non-Federal entity must establish and maintain effective internal control over the Federal award. Also, CFR 200.302(b)(3) states the financial management system of each non-Federal entity must provide records that identify adequately, among other things, proper authorizations. Cause: Internal controls over cash disbursements were overridden. The County’s policy is to require two signatures on all checks, as well as a completed claim form which is approved by a department head, the county clerk, and a member of the claims committee. Effect: Unauthorized or improper use of grant funds could occur. Context: A total of thirteen disbursements was selected for testing, which was 100% of the population. The use of grant funds for the purpose of these disbursements was previously approved by the county board. Therefore, there are no questioned costs. Recommendation: Management should follow the internal control policies in effect for the disbursement of other County funds in the disbursement of CSLFRF grant funds. Views of Responsible Officials and Planned Corrective Actions: Management will follow controls implemented over approving claim forms and signing checks for other County disbursements for CSLFRF grant disbursements.
COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) – Federal Assistance Listing Number 20.027 Condition: We noted one disbursement of grant funds supported by a claim form with only one source of approval. Another disbursement was supported by a claim form with only one source of approval and the check issued was signed by only one authorized signer. Criteria: 2 CFR 200.303(a) states the non-Federal entity must establish and maintain effective internal control over the Federal award. Also, CFR 200.302(b)(3) states the financial management system of each non-Federal entity must provide records that identify adequately, among other things, proper authorizations. Cause: Internal controls over cash disbursements were overridden. The County’s policy is to require two signatures on all checks, as well as a completed claim form which is approved by a department head, the county clerk, and a member of the claims committee. Effect: Unauthorized or improper use of grant funds could occur. Context: A total of thirteen disbursements was selected for testing, which was 100% of the population. The use of grant funds for the purpose of these disbursements was previously approved by the county board. Therefore, there are no questioned costs. Recommendation: Management should follow the internal control policies in effect for the disbursement of other County funds in the disbursement of CSLFRF grant funds. Views of Responsible Officials and Planned Corrective Actions: Management will follow controls implemented over approving claim forms and signing checks for other County disbursements for CSLFRF grant disbursements.
2023-003 REPORTING Federal Program Information: Federal Agency and Program Name Federal Assistance Listing Number National Endowment for the Humanities Promotion of the Humanities Federal/State Partnership Grant Number: SO-289836-23 45.129 Criteria: 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.302(b) states that “the financial management system of each non-Federal entity must provide for… accurate, current, and complete disclosure of the financial results of each Federal award or program…” Condition: For both of the SF-425 reports selected for testing, there was no documentation of review and approval of the SF-425 report prior to submission. For one of the SF-425 reports selected for testing, inaccurate data was input and submitted. Questioned Costs: None Context: Total federal expenditures for the Promotion of the Humanities Federal/State Partnership program were $1,019,055 for the year ended October 31, 2023. Cause: The Council does not have adequate internal controls and policies and procedures in place to ensure that reports contain accurate financial information and are reviewed before submission. Effect: The Council is not reporting accurate financial information to its federal grantor. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Council implement controls and policies and procedures over financial reporting to ensure compliance with federal reporting requirements. Views of Responsible Officials: Management acknowledges the finding. See corrective action plan.
2023-003 REPORTING Federal Program Information: Federal Agency and Program Name Federal Assistance Listing Number National Endowment for the Humanities Promotion of the Humanities Federal/State Partnership Grant Number: SO-289836-23 45.129 Criteria: 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.302(b) states that “the financial management system of each non-Federal entity must provide for… accurate, current, and complete disclosure of the financial results of each Federal award or program…” Condition: For both of the SF-425 reports selected for testing, there was no documentation of review and approval of the SF-425 report prior to submission. For one of the SF-425 reports selected for testing, inaccurate data was input and submitted. Questioned Costs: None Context: Total federal expenditures for the Promotion of the Humanities Federal/State Partnership program were $1,019,055 for the year ended October 31, 2023. Cause: The Council does not have adequate internal controls and policies and procedures in place to ensure that reports contain accurate financial information and are reviewed before submission. Effect: The Council is not reporting accurate financial information to its federal grantor. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Council implement controls and policies and procedures over financial reporting to ensure compliance with federal reporting requirements. Views of Responsible Officials: Management acknowledges the finding. See corrective action plan.
S3800-010 Finding Reference Number – 2023-002 S3800-011 Title and CFDA Number of Federal Program – Section 232 Loan – Mortgage Insurance Nursing Homes, Intermediate Care Facilities, Board and Care Homes and Assisted Living Facilities Loan, ALN 14.129 S3800-015 Type of Finding – Federal Award Finding Other Matters S3800-016 Finding Resolution Status – In progress S3800-017 Information on Universe Population Size – 1,710 checks and bank transfers, all disbursements from bank accounts. S3800-018 Sample Size Information – Sample size was 49 disbursements. Errors were found on 2 out of the 49 disbursements tested. S3800-019 Identification of Repeat Finding and Finding Reference Number – N/A S3800-020 Criteria – Per 2 CFR sections 200.302 and 200.303 of the Uniform Guidance, an entity must establish and maintain effective internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. Allowable cost controls of Cheney Care Community require general ledger account coding to be written on each invoice to be reviewed by the Executive Director before the invoice is processed to be paid. S3800-030 Statement of Condition – During our audit, we noted two invoices that did not include the general ledger account coding on the invoices, as required by Cheney Care Community’s allowable cost controls. The invoices were recorded to the proper general ledger accounts. S3800-032 Cause – Cheney Care Community did not follow their documented internal controls over financial reporting and allowable costs to ensure general ledger coding is included on each invoice for review and approval. S3800-033 Effect or Potential Effect – Failure to maintain effective internal controls over compliance with federal requirements increases the risk of unauthorized or unallowable transactions occurring. S3800-035 Auditor Non-Compliance Code – S (Internal Controls) S3800-037 FHA/Contract Number – 171-22029 S3800-038 Questioned Costs – $0 S3800-040 Questioned Costs – $0 S3800-045 Reporting Views of Responsible Officials – Cheney Care Community is in agreement with the findings, and the recommendations have been implemented. S3800-050 Context – A sample of 49 checks totaling $206,327 was selected for audit from a population of 1,710 checks totaling $11,294,298. The test found two checks that were not in compliance with Cheney Care Community’s allowable cost controls totaling $93. The invoices were recorded to the proper general ledger accounts. Our sample was a statistically valid sample. S3800-080 Recommendation – We recommend management of Cheney Care Community review their internal controls over the cash disbursement process with the necessary individuals involved in the process to ensure the implementation of general ledger account coding on cash disbursements is consistently performed going forward. S3800-090 Auditor’s Summary of Auditee Comments on the Findings and Recommendations – The Executive Director and A/P Clerk agreed upon using certain general ledger account codes consistently for similar purchases from the same vendor. In Cheney Care Community’s accounting system, these agreed upon general ledger account codes have been pre-set as a default for certain vendors. When invoices are received that should be appropriately coded to this default general ledger account code, errors of not documenting the general ledger account code on the invoice are periodically made. Cheney Care Community will consistently perform the general ledger account coding internal control procedures on invoices going forward. S3800-130 Response Indicator – Agree S3800-140 Completion Date – September 30, 2024 S3800-150 Response – Cheney Care Community will consistently perform the general ledger account coding internal control procedures on invoices going forward.
S3800-010 Finding Reference Number – 2023-002 S3800-011 Title and CFDA Number of Federal Program – Section 202 Supportive Housing for the Elderly, Capital Advance and Project Rental Assistance Contract, ALN 14.157 S3800-015 Type of Finding – Federal Award Finding; Other Matters S3800-016 Finding Resolution Status – In progress S3800-017 Information on Universe Population Size – 202 checks and bank transfers, all disbursements from bank accounts S3800-018 Sample Size Information – Sample size was 40 disbursements. Errors were found on 1 out of the 40 disbursements tested. S3800-019 Identification of Repeat Finding and Finding Reference Number – N/A S3800-020 Criteria – Per 2 CFR sections 200.302 and 200.303 of the Uniform Guidance, an entity must establish and maintain effective internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. Allowable cost controls of Sessions Village 202 require general ledger account coding to be written on each invoice to be reviewed by the Executive Director before the invoice is processed to be paid. S3800-030 Statement of Condition – During our audit, we noted one invoice that did not include the general ledger account coding on the invoice, as required by Sessions Village 202’s allowable cost controls. The invoice was recorded to the proper general ledger account. S3800-032 Cause – Sessions Village 202 did not follow their documented internal controls over financial reporting and allowable costs to ensure general ledger coding is included on each invoice for review and approval. S3800-033 Effect or Potential Effect – Failure to maintain effective internal controls over compliance with federal requirements increases the risk of unauthorized or unallowable transactions occurring. S3800-035 Auditor Non-Compliance Code – S (Internal Controls) S3800-037 FHA/Contract Number – 171-EE015 S3800-038 Questioned Costs – $0 S3800-040 Questioned Costs – $0 S3800-045 Reporting Views of Responsible Officials – Sessions Village 202 is in agreement with the findings, and the recommendations have been implemented. S3800-050 Context – A sample of 40 checks totaling $41,900 was selected for audit from a population of 202 checks totaling $186,253. The test found one check that was not in compliance with Sessions Village 202’s allowable cost controls totaling $369. The invoice was recorded to the proper general ledger account. Our sample was a statistically valid sample. S3800-080 Recommendation – We recommend management of Sessions Village 202 review their internal controls over the cash disbursement process with the necessary individuals involved in the process to ensure the implementation of general ledger account coding on cash disbursements is consistently performed going forward. S3800-090 Auditor’s Summary of Auditee Comments on the Findings and Recommendations – The Executive Director and A/P Clerk agreed upon using certain general ledger account codes consistently for similar purchases from the same vendor. In Sessions Village 202’s accounting system, these agreed upon general ledger account codes have been pre-set as a default for certain vendors. When invoices are received that should be appropriately coded to this default general ledger account code, errors of not documenting the general ledger account code on the invoice are periodically made. Sessions Village 202 will consistently perform the general ledger account coding internal control procedures on invoices going forward. S3800-130 Response Indicator – Agree S3800-140 Completion Date – September 30, 2024 S3800-150 Response – Sessions Village 202 will consistently perform the general ledger account coding internal control procedures on invoices going forward.
S3800-010 Finding Reference Number – 2023-002 S3800-011 Title and CFDA Number of Federal Program – Section 202 Supportive Housing for the Elderly, Capital Advance and Project Rental Assistance Contract, ALN 14.157 S3800-015 Type of Finding – Federal Award Finding; Other Matters S3800-016 Finding Resolution Status – In progress S3800-017 Information on Universe Population Size – 202 checks and bank transfers, all disbursements from bank accounts S3800-018 Sample Size Information – Sample size was 40 disbursements. Errors were found on 1 out of the 40 disbursements tested. S3800-019 Identification of Repeat Finding and Finding Reference Number – N/A S3800-020 Criteria – Per 2 CFR sections 200.302 and 200.303 of the Uniform Guidance, an entity must establish and maintain effective internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. Allowable cost controls of Sessions Village 202 require general ledger account coding to be written on each invoice to be reviewed by the Executive Director before the invoice is processed to be paid. S3800-030 Statement of Condition – During our audit, we noted one invoice that did not include the general ledger account coding on the invoice, as required by Sessions Village 202’s allowable cost controls. The invoice was recorded to the proper general ledger account. S3800-032 Cause – Sessions Village 202 did not follow their documented internal controls over financial reporting and allowable costs to ensure general ledger coding is included on each invoice for review and approval. S3800-033 Effect or Potential Effect – Failure to maintain effective internal controls over compliance with federal requirements increases the risk of unauthorized or unallowable transactions occurring. S3800-035 Auditor Non-Compliance Code – S (Internal Controls) S3800-037 FHA/Contract Number – 171-EE015 S3800-038 Questioned Costs – $0 S3800-040 Questioned Costs – $0 S3800-045 Reporting Views of Responsible Officials – Sessions Village 202 is in agreement with the findings, and the recommendations have been implemented. S3800-050 Context – A sample of 40 checks totaling $41,900 was selected for audit from a population of 202 checks totaling $186,253. The test found one check that was not in compliance with Sessions Village 202’s allowable cost controls totaling $369. The invoice was recorded to the proper general ledger account. Our sample was a statistically valid sample. S3800-080 Recommendation – We recommend management of Sessions Village 202 review their internal controls over the cash disbursement process with the necessary individuals involved in the process to ensure the implementation of general ledger account coding on cash disbursements is consistently performed going forward. S3800-090 Auditor’s Summary of Auditee Comments on the Findings and Recommendations – The Executive Director and A/P Clerk agreed upon using certain general ledger account codes consistently for similar purchases from the same vendor. In Sessions Village 202’s accounting system, these agreed upon general ledger account codes have been pre-set as a default for certain vendors. When invoices are received that should be appropriately coded to this default general ledger account code, errors of not documenting the general ledger account code on the invoice are periodically made. Sessions Village 202 will consistently perform the general ledger account coding internal control procedures on invoices going forward. S3800-130 Response Indicator – Agree S3800-140 Completion Date – September 30, 2024 S3800-150 Response – Sessions Village 202 will consistently perform the general ledger account coding internal control procedures on invoices going forward.
2023-005 Internal Controls over Grant Management (Significant Deficiency and Noncompliance) Criteria: 2 CFR 200.302 establishes the requirements of a financial management system adequate to ensure compliance with federal regulations. This system must include written procedures to implement requirements for payment methods and determine the allowability of costs in accordance with subpart E. Statement of Condition: The City has written fiscal policies but they do not meet the financial management system requirements established in the regulations. Cause: The City has processes and procedures in place to administer grant funds but written policies do not contain compliance requirements. Effect: The City is not in compliance with financial management system requirements. Recommendation: The City should develop a grants manual or additional written policies to incorporate all the requirements of 2 CFR 200 and ensure compliance. Views of Management and Planned Corrective Action: See Corrective Action Plan included at the end of the report.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.