Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
2023-002 Grant Payroll Documentation and Recordkeeping Federal Agency: U.S Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Identification Number and Year: SLFRP3404 - 2021 Award Period: March 3, 2021 through December 31, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matter Criteria: Compliance: 2 CFR 200.302(b)(3) states that records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. 2 CFR 200.403 states that costs must be adequately documented. Controls: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the ”Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The County did not maintain documentation supporting certain payroll expenditures charged to the grant. Questioned Costs: Under $25,000. Context: For four of the sixty employee pays selected for testing the underlying payroll records did not support the amount charged to the grant. Cause: Payroll documentation supporting the wage amounts charged to the grant program was not properly maintained by the County. Effect: Failure to maintain supporting documentation to the employee payroll charged to grant programs may result in unallowed cost and activities being charged to the grant, causing noncompliance with the Federal compliance requirements. Repeat Finding: No Recommendation: We recommend the County establish internal control procedures to ensure that all amounts charged to grant programs for employee payroll costs be reconciled to the specific employee payroll records and that supporting documentation be maintained throughout the grant award period and beyond.
Finding 2023-006 – Allowable Costs - Payroll costs (Material Weakness and Noncompliance) Information on the federal program: U.S. Department of Veterans Affairs, Assistance Listing #64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program; U.S. Department of Health and Human Services, Assistance Listing #93.137 Community Programs to Improve Minority Health Grant Program; and U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 78 payroll disbursements over 3 grant programs. Of those 78, 9 exceptions were noted. The amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. Cause: Employee timesheets are turned in after payroll is processed and allocations made, timesheets in these exceptions did not agree to the amount allocated. Effect: The Council did not comply with financial management requirements. Questioned Costs: None Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation properly supports the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2023-006 – Allowable Costs - Payroll costs (Material Weakness and Noncompliance) Information on the federal program: U.S. Department of Veterans Affairs, Assistance Listing #64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program; U.S. Department of Health and Human Services, Assistance Listing #93.137 Community Programs to Improve Minority Health Grant Program; and U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 78 payroll disbursements over 3 grant programs. Of those 78, 9 exceptions were noted. The amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. Cause: Employee timesheets are turned in after payroll is processed and allocations made, timesheets in these exceptions did not agree to the amount allocated. Effect: The Council did not comply with financial management requirements. Questioned Costs: None Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation properly supports the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2023-006 – Allowable Costs - Payroll costs (Material Weakness and Noncompliance) Information on the federal program: U.S. Department of Veterans Affairs, Assistance Listing #64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program; U.S. Department of Health and Human Services, Assistance Listing #93.137 Community Programs to Improve Minority Health Grant Program; and U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 78 payroll disbursements over 3 grant programs. Of those 78, 9 exceptions were noted. The amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. Cause: Employee timesheets are turned in after payroll is processed and allocations made, timesheets in these exceptions did not agree to the amount allocated. Effect: The Council did not comply with financial management requirements. Questioned Costs: None Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation properly supports the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2023-006 – Allowable Costs - Payroll costs (Material Weakness and Noncompliance) Information on the federal program: U.S. Department of Veterans Affairs, Assistance Listing #64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program; U.S. Department of Health and Human Services, Assistance Listing #93.137 Community Programs to Improve Minority Health Grant Program; and U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 78 payroll disbursements over 3 grant programs. Of those 78, 9 exceptions were noted. The amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. Cause: Employee timesheets are turned in after payroll is processed and allocations made, timesheets in these exceptions did not agree to the amount allocated. Effect: The Council did not comply with financial management requirements. Questioned Costs: None Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation properly supports the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2023-006 – Allowable Costs - Payroll costs (Material Weakness and Noncompliance) Information on the federal program: U.S. Department of Veterans Affairs, Assistance Listing #64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program; U.S. Department of Health and Human Services, Assistance Listing #93.137 Community Programs to Improve Minority Health Grant Program; and U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 78 payroll disbursements over 3 grant programs. Of those 78, 9 exceptions were noted. The amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. Cause: Employee timesheets are turned in after payroll is processed and allocations made, timesheets in these exceptions did not agree to the amount allocated. Effect: The Council did not comply with financial management requirements. Questioned Costs: None Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation properly supports the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2023-006 – Allowable Costs - Payroll costs (Material Weakness and Noncompliance) Information on the federal program: U.S. Department of Veterans Affairs, Assistance Listing #64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program; U.S. Department of Health and Human Services, Assistance Listing #93.137 Community Programs to Improve Minority Health Grant Program; and U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 78 payroll disbursements over 3 grant programs. Of those 78, 9 exceptions were noted. The amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. Cause: Employee timesheets are turned in after payroll is processed and allocations made, timesheets in these exceptions did not agree to the amount allocated. Effect: The Council did not comply with financial management requirements. Questioned Costs: None Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation properly supports the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2023-008 – Activities Allowed (Significant Deficiency and Noncompliance) Information on the federal program: U.S. Department of Veterans Affairs, Assistance Listing #64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure funds have been used in accordance with Federal statues, regulations, and terms and conditions of the Federal award. These requirements include that the nonfederal entity compare expenditures with the approved award budget. Condition: We tested 22 nonpayroll disbursements, 2 of those expenses did not fit into an expense category in the approved award budget. Cause: The Council began allocating nonreimbursable expenses to their grant codes to track the true costs of running a program. This grant allowed for indirect costs, however these costs were charged directly to the grant and were included in the amount requested for reimbursement and also in the cost base used for the indirect cost calculation. These costs were not in line with the categories of expenses in the award budget. Effect: The Council did not comply with allowable activities requirements. Questioned Costs: $1,901 Recommendation: We recommend the Council strengthen procedures over costs invoiced for reimbursement to ensure those costs are compared to the grant budget for allowability. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
FINDING 2023-023 Pandemic EBT Food Benefits, ALN 10.542, Reporting - Accuracy of Financial Reports See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not submit accurate monthly P-EBT financial reports to the U.S. Department of Agriculture (USDA) Food and Nutrition Service (FNS) for 1 of 3 sampled Report of Disaster Supplemental Nutrition Assistance Benefit Issuance (FNS-292B). For this 1 instance, MDHHS reported inaccurate disaster relief information in the October 2022 FNS-292B. MDHHS overstated: a. Total value of benefits issued by $377.9 million. b. Number of persons issued benefits by 963,633. c. Number of households issued benefits by 802,454. Criteria Federal regulation 2 CFR 200.302(b)(2) requires grantees to submit accurate financial data in accordance with a grant program's reporting requirements. Federal Register 86:89 (11 May 2021) page 25,837 requires state agencies to report the number of eligible children and households receiving P-EBT benefits and total value of the benefits monthly. Cause MDHHS informed us its monitoring activities were not sufficient to detect data entry errors included in the submitted report. Effect MDHHS may have diminished the federal grantor agency's ability to ensure appropriate oversight and monitoring of P-EBT funds. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS improve its internal control and submit accurate P-EBT financial reports. Management Views MDHHS agrees with the finding.
Federal Aid Policies Finding 2023-002 Condition: The Authority’s management has completely turned over and been restructured. However, the Authority’s policies for federal aid approved in 2021 have not been revised to update for the current management structure. The policies have also not been updated for changes in the 2 CFR 200 that have occurred. Criteria: The 2 CFR 200 requires the adoption of federal aid policies and that they are to be updated and maintained in accordance with the federal regulations. These policies include the following along with the 2 CFR 200 reference. a. Cash Management Procedure –200.302(b)(6) and 200.305 b. Cost Allowability Procedures –200.302(b)(7) c. Conflicts of Interest Policy –200.318(c) d. Procurement Procedures –200.318(a) and 200.319(d) e. Method for Conducting Technical Evaluations of Proposals and Selecting Recipients –200.320(b)(2)(ii) f. Travel Policy –200.475(a) g. Procedures for Managing Equipment –200.313(d) h. Employee Benefits –200.431 Cause: The Authority has experienced a high turnover of employees since 2021 when the policies were adopted and have not been reviewed since their adoption. Effect: The Authority is noncompliant with 2 CFR 200. Directive: We direct the Authority review and update all federal aid policies and implement procedures to ensure that they are being reviewed at least once a year for changes in the Authority’s management structure or changes that occur in the 2 CFR 200. Management’s Response--Corrective Action Plan: Contact person is Rufus Adams, Executive Director, 275 East Wall Street, P.O. Box 837, Benton Harbor, Michigan 49023. Telephone (269) 927-2268. The Authority will update their federal policies to comply with 2 CFR 200 and will review all policies on an annual basis going forward.
Federal Aid Policies Finding 2023-002 Condition: The Authority’s management has completely turned over and been restructured. However, the Authority’s policies for federal aid approved in 2021 have not been revised to update for the current management structure. The policies have also not been updated for changes in the 2 CFR 200 that have occurred. Criteria: The 2 CFR 200 requires the adoption of federal aid policies and that they are to be updated and maintained in accordance with the federal regulations. These policies include the following along with the 2 CFR 200 reference. a. Cash Management Procedure –200.302(b)(6) and 200.305 b. Cost Allowability Procedures –200.302(b)(7) c. Conflicts of Interest Policy –200.318(c) d. Procurement Procedures –200.318(a) and 200.319(d) e. Method for Conducting Technical Evaluations of Proposals and Selecting Recipients –200.320(b)(2)(ii) f. Travel Policy –200.475(a) g. Procedures for Managing Equipment –200.313(d) h. Employee Benefits –200.431 Cause: The Authority has experienced a high turnover of employees since 2021 when the policies were adopted and have not been reviewed since their adoption. Effect: The Authority is noncompliant with 2 CFR 200. Directive: We direct the Authority review and update all federal aid policies and implement procedures to ensure that they are being reviewed at least once a year for changes in the Authority’s management structure or changes that occur in the 2 CFR 200. Management’s Response--Corrective Action Plan: Contact person is Rufus Adams, Executive Director, 275 East Wall Street, P.O. Box 837, Benton Harbor, Michigan 49023. Telephone (269) 927-2268. The Authority will update their federal policies to comply with 2 CFR 200 and will review all policies on an annual basis going forward.
Federal Aid Policies Finding 2023-002 Condition: The Authority’s management has completely turned over and been restructured. However, the Authority’s policies for federal aid approved in 2021 have not been revised to update for the current management structure. The policies have also not been updated for changes in the 2 CFR 200 that have occurred. Criteria: The 2 CFR 200 requires the adoption of federal aid policies and that they are to be updated and maintained in accordance with the federal regulations. These policies include the following along with the 2 CFR 200 reference. a. Cash Management Procedure –200.302(b)(6) and 200.305 b. Cost Allowability Procedures –200.302(b)(7) c. Conflicts of Interest Policy –200.318(c) d. Procurement Procedures –200.318(a) and 200.319(d) e. Method for Conducting Technical Evaluations of Proposals and Selecting Recipients –200.320(b)(2)(ii) f. Travel Policy –200.475(a) g. Procedures for Managing Equipment –200.313(d) h. Employee Benefits –200.431 Cause: The Authority has experienced a high turnover of employees since 2021 when the policies were adopted and have not been reviewed since their adoption. Effect: The Authority is noncompliant with 2 CFR 200. Directive: We direct the Authority review and update all federal aid policies and implement procedures to ensure that they are being reviewed at least once a year for changes in the Authority’s management structure or changes that occur in the 2 CFR 200. Management’s Response--Corrective Action Plan: Contact person is Rufus Adams, Executive Director, 275 East Wall Street, P.O. Box 837, Benton Harbor, Michigan 49023. Telephone (269) 927-2268. The Authority will update their federal policies to comply with 2 CFR 200 and will review all policies on an annual basis going forward.
Federal Aid Policies Finding 2023-002 Condition: The Authority’s management has completely turned over and been restructured. However, the Authority’s policies for federal aid approved in 2021 have not been revised to update for the current management structure. The policies have also not been updated for changes in the 2 CFR 200 that have occurred. Criteria: The 2 CFR 200 requires the adoption of federal aid policies and that they are to be updated and maintained in accordance with the federal regulations. These policies include the following along with the 2 CFR 200 reference. a. Cash Management Procedure –200.302(b)(6) and 200.305 b. Cost Allowability Procedures –200.302(b)(7) c. Conflicts of Interest Policy –200.318(c) d. Procurement Procedures –200.318(a) and 200.319(d) e. Method for Conducting Technical Evaluations of Proposals and Selecting Recipients –200.320(b)(2)(ii) f. Travel Policy –200.475(a) g. Procedures for Managing Equipment –200.313(d) h. Employee Benefits –200.431 Cause: The Authority has experienced a high turnover of employees since 2021 when the policies were adopted and have not been reviewed since their adoption. Effect: The Authority is noncompliant with 2 CFR 200. Directive: We direct the Authority review and update all federal aid policies and implement procedures to ensure that they are being reviewed at least once a year for changes in the Authority’s management structure or changes that occur in the 2 CFR 200. Management’s Response--Corrective Action Plan: Contact person is Rufus Adams, Executive Director, 275 East Wall Street, P.O. Box 837, Benton Harbor, Michigan 49023. Telephone (269) 927-2268. The Authority will update their federal policies to comply with 2 CFR 200 and will review all policies on an annual basis going forward.
Federal Aid Policies Finding 2023-002 Condition: The Authority’s management has completely turned over and been restructured. However, the Authority’s policies for federal aid approved in 2021 have not been revised to update for the current management structure. The policies have also not been updated for changes in the 2 CFR 200 that have occurred. Criteria: The 2 CFR 200 requires the adoption of federal aid policies and that they are to be updated and maintained in accordance with the federal regulations. These policies include the following along with the 2 CFR 200 reference. a. Cash Management Procedure –200.302(b)(6) and 200.305 b. Cost Allowability Procedures –200.302(b)(7) c. Conflicts of Interest Policy –200.318(c) d. Procurement Procedures –200.318(a) and 200.319(d) e. Method for Conducting Technical Evaluations of Proposals and Selecting Recipients –200.320(b)(2)(ii) f. Travel Policy –200.475(a) g. Procedures for Managing Equipment –200.313(d) h. Employee Benefits –200.431 Cause: The Authority has experienced a high turnover of employees since 2021 when the policies were adopted and have not been reviewed since their adoption. Effect: The Authority is noncompliant with 2 CFR 200. Directive: We direct the Authority review and update all federal aid policies and implement procedures to ensure that they are being reviewed at least once a year for changes in the Authority’s management structure or changes that occur in the 2 CFR 200. Management’s Response--Corrective Action Plan: Contact person is Rufus Adams, Executive Director, 275 East Wall Street, P.O. Box 837, Benton Harbor, Michigan 49023. Telephone (269) 927-2268. The Authority will update their federal policies to comply with 2 CFR 200 and will review all policies on an annual basis going forward.
Finding Number: 2023-011 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: Government Department/Agency: U.S. Department of the Treasury COVID-19 – Emergency Rental Assistance (ERA) Program ALN: 21.023 Award #: N/A Award Year: 12/27/2020 – 09/30/2025 Department of Human Services (DHS) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Certain grant expenditures amounting to approximately $42.4 million, had erroneously been reflected as expenditures under assistance listing number 21.023, COVID-19 – Emergency Rental Assistance Program. Subsequently, DHS adjusted the SEFA to reflect the actual amount of expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of the DHS’ compliance with the specified requirements. Effect – DHS is not in compliance with the stated provisions. Failure to properly review and support expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – DHS did not appear to have adequate policies and procedures in place to ensure accuracy of the SEFA. Recommendation – We recommend that DHS adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS OCFO concurs with the finding. Initially, the expenditures were inadvertently categorized to the incorrect program. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.
Finding Number: 2023-017 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: Government Department/Agency: U.S. Department of Education COVID-19 – Education Stabilization Fund Elementary and Secondary School Emergency Relief (ESSER) Fund ALN: 84.425D Award #: S425D210034 Award Year: 05/07/2020 – 09/30/2023 COVID-19 – Education Stabilization Fund American Rescue Plan - Elementary and Secondary Schools Emergency Relief Fund (ARP-ESSER) ALN: 84.425U Award #: S425U210034-21A Award Year: 03/24/2021 – 09/30/2023 Office of the State Superintendent of Education (OSSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Certain grant expenditures amounting to approximately $9.7 million, had erroneously been reflected as expenditures under assistance listing number 84.425D, Elementary and Secondary School Emergency Relief (ESSER) Fund. Subsequently, OSSE adjusted the SEFA to reflect the expenditure to 84.425U, American Rescue Plan - Elementary and Secondary Schools Emergency Relief Fund. Further, the amount of subrecipient expenses initially reported is overstated by $269,140. Subsequently, OSSE adjusted the SEFA to reflect the actual amount of subrecipient expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of OSSE’s compliance with the specified requirements. Effect – OSSE is not in compliance with the stated provisions. Failure to properly review and support expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – OSSE did not appear to have adequate policies and procedures in place to ensure accuracy of the SEFA. Recommendation – We recommend that OSSE adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – OSSE agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.
Finding Number: 2023-017 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: Government Department/Agency: U.S. Department of Education COVID-19 – Education Stabilization Fund Elementary and Secondary School Emergency Relief (ESSER) Fund ALN: 84.425D Award #: S425D210034 Award Year: 05/07/2020 – 09/30/2023 COVID-19 – Education Stabilization Fund American Rescue Plan - Elementary and Secondary Schools Emergency Relief Fund (ARP-ESSER) ALN: 84.425U Award #: S425U210034-21A Award Year: 03/24/2021 – 09/30/2023 Office of the State Superintendent of Education (OSSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Certain grant expenditures amounting to approximately $9.7 million, had erroneously been reflected as expenditures under assistance listing number 84.425D, Elementary and Secondary School Emergency Relief (ESSER) Fund. Subsequently, OSSE adjusted the SEFA to reflect the expenditure to 84.425U, American Rescue Plan - Elementary and Secondary Schools Emergency Relief Fund. Further, the amount of subrecipient expenses initially reported is overstated by $269,140. Subsequently, OSSE adjusted the SEFA to reflect the actual amount of subrecipient expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of OSSE’s compliance with the specified requirements. Effect – OSSE is not in compliance with the stated provisions. Failure to properly review and support expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – OSSE did not appear to have adequate policies and procedures in place to ensure accuracy of the SEFA. Recommendation – We recommend that OSSE adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – OSSE agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.
Item 2023‐002 Written policies, procedures, and standards of conduct COVID 19 – Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number 21.027 U.S. Department of Treasury Grant period: Year ended September 30, 2023 Questioned Costs – $0 Condition – The City does not have all of the written policies, procedures and standards of conduct required by UG. Criteria – 2 CFR 200.303 requires the non‐Federal entity to “(a) establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non‐Federal entity is managing the Federal statutes, regulations, and the terms and conditions of the Federal award.” Grantees should have written policies, procedures, and standards of conduct as required by 2 CFR 200, Subparts D & E of the Uniform Guidance. 2 CFR 200, Subparts D & E requires the non‐ Federal entity to establish and maintain written policies, procedures, and standards of conduct including internal controls over the Federal awards that provides reasonable assurance that the non‐ Federal entity is managing the Federal statutes, regulations, and the terms and conditions of the Federal award. Specific requirements relate to the following: § 200.302 Financial management § 200.305 Payment § 200.319 Competition § 200.320 Methods of procurement to be followed § 200.430 Compensation—personal services § 200.431 Compensation—fringe benefits Cause of Condition – The City has failed to prepare written policies, procedures, and standards of conduct as required by 2 CFR 200, Subparts D & E of the Uniform Guidance. Potential Effect of Condition – Lack of written policies, procedures, and standards of conduct could result in noncompliance related to federal awards. Recommendation – We recommend that the City implement the required written policies and procedures. Management’s Response – Management agrees with the finding and will implement the necessary written policies to comply with the UG. Management anticipates completion by September 30, 2024.
MANAGEMENT DID NOT HAVE WRITTEN INTERNAL CONTROL PROCEDURES FOR DETERMINING ALLOWABLE COSTS. 2 CFR 200 SUBPART 3, SECTION 200.302(B)(7) REQUIRES WRITTEN PROCEDURES FOR DETERMINING THE ALLOWABILITY OF COSTS IN ACCORDANCE WITH SUBPART E - COST PRINCIPLES OF THIS PART AND THE TERMS AND CONDITIONS OF THE FEDERAL AWARD. NO QUESTIONED COSTS. CAUSE IS THE LACK OF WRITTEN CONTROLS TO IDENTIFY ALLOWABLE COSTS AND SPECIAL TESTS AND PROVISIONS. THIS WAS A REPEAT FINDING. IT WAS PREVIOUSLY NOTED AS FINDING 2022-002
MANAGEMENT DID NOT HAVE WRITTEN INTERNAL CONTROL PROCEDURES FOR DETERMINING ALLOWABLE COSTS. 2 CFR 200 SUBPART 3, SECTION 200.302(B)(7) REQUIRES WRITTEN PROCEDURES FOR DETERMINING THE ALLOWABILITY OF COSTS IN ACCORDANCE WITH SUBPART E - COST PRINCIPLES OF THIS PART AND THE TERMS AND CONDITIONS OF THE FEDERAL AWARD. NO QUESTIONED COSTS. CAUSE IS THE LACK OF WRITTEN CONTROLS TO IDENTIFY ALLOWABLE COSTS AND SPECIAL TESTS AND PROVISIONS. THIS WAS A REPEAT FINDING. IT WAS PREVIOUSLY NOTED AS FINDING 2022-002
Finding 2023-003 Inadequate Tracking of Federal Expenses (Allowable Costs) Federal Programs: All Criteria: In accordance with CFR 200.302 organizations receiving Federal awards must maintain accurate records that adequately identify the source and application of Federal funds. This includes tracking Federal expenditures separately and distinctly within their accounting system. Additionally, in accordance with CFR 200.303, the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Organization's use of class codes in QuickBooks to track Federal expenses was found to be inadequate. Although the Organization uses QuickBooks to record financial transactions, there is no systematic method in place to ensure that Federal expenditures are properly classified and tracked using distinct class codes. Cause: The deficiency in tracking Federal expenses within QuickBooks using class codes appears to stem from a lack of understanding or awareness of the requirements outlined in Uniform Guidance. Additionally, there may be insufficient training provided to staff responsible for financial management and accounting practices. Effect or Potential Effect: Without proper tracking of Federal expenses using class codes, the Organization risks commingling Federal funds with other sources of revenue, which could lead to inaccurate reporting and potential non-compliance with Uniform Guidance requirements. This deficiency increases the likelihood of errors in financial reporting and raises concerns about the Organization's ability to demonstrate proper stewardship of Federal funds. Questioned Costs: Indeterminable. Context: The Organization does not currently use its financial management system to leverage the tracking of Federal funds between programs; the tracking is currently manual, based on Excel spreadsheets, and difficult to track/audit. Recommendation: It is recommended that the Organization establish and implement procedures to effectively track Federal expenses within QuickBooks using distinct class codes in accordance with 2 CFR 200.302. This may involve providing training to staff on the proper use of class codes and ensuring that all Federal expenditures are consistently and accurately classified in the accounting system.