Criteria: Under the Uniform Guidance, specifically 2 CFR 200.430, charges to Federal awards for compensation must be supported by a system of internal control which provides reasonable assurance that costs are allocated appropriately and accurately. Per 2 CFR §200.403, allowable costs must be "necessary, reasonable, and adequately documented." Additionally, 2 CFR §200.302(b)(3) requires non-Federal entities to maintain records that sufficiently detail financial transactions to support Federal expenditures. Condition: During our testing of payments charged to the federal major program, we noted that employee timesheets lacked evidence of review and approval. Certain employees charged to the grant did not prepare timesheets and a separate tracking system was used. Federal regulations require that expenditures charged to Federal awards be properly reviewed, approved, and documented to ensure allowability and compliance with grant terms. Cause: The Federal program was new to the organization and controls over the program had not been fully established. Turnover in the accounting department contributed to the lack of resources for tracking these costs. Effect or potential effect: Management provided documentation on personnel costs allocated to the program, but was unable to provide evidence of review. Lack of review increases the risk of unauthorized or unallowable costs being charged to the Federal award, potentially leading to questioned costs and noncompliance with Federal grant requirements. Context: This issue applied to less than 10% of the grant expenditures, $54,505 out of the $897,736 of total expenditures charged to the grant. Recommendation: Management should review the requirements of CFR 200.430 and ensure that current processes, whether digital or hard-copy driven, are consistent with the requirements of the Uniform Guidance. In addition, management should consider adding additional staff to its accounting and/or grants management team. Views of responsible officials: Management will evaluate systems and processes to ensure time tracking procedures meet the standards outlined in the Uniform Guidance.
Finding 2023-001 - U.S. Department of Housing and Urban Development, Mortgage Insurance Rental and Cooperative Housing for Moderate Income Families and Elderly, Market Interest Rate, ALN #14.135 Statement of Condition: Internal control processes over financial accounting did not ensure that all transactions were properly recorded. Internal control processes over financial accounting did not ensure that key accounts were reconciled or reviewed on a periodic basis. Criteria: The HUD Handbook 4370.2 REV-1, Chapter 2 requires the books and accounts to be complete and accurate. HUD Handbook 4370.2 REV-1, Chapter 2, Section 12 requires monthly reconciliations of all cash accounts. Additionally, 2 CFR Part 200 Section 200.302 Financial Management states that the financial management system of each non-federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award in accordance with the reporting requirements. Additionally, 2 CFR Part 200 Section 200.303(a), Internal Controls, requires that non-federal entities must establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the award in compliance with federal statutes, regulations and the terms and conditions. Effect: Noncompliance with HUD and Uniform Guidance requirements and the possibility of undetected material misstatements and/or undetected misappropriation of assets. Cause: Prior management oversight. Context: An understanding of processes and internal controls was performed with the Corporation's management and tests were performed to determine if the processes and internal controls were implemented and effective. As part of this process we noted the following processes and internal controls were not effective and/or implemented. 1) Only two of the six bank accounts were reconciled. The outsourced bookkeeper only performed a bank reconciliation for the operating and security deposit cash accounts. 2) The accounts receivable, tenants and accounts receivable, HUD were not reconciled. 3) The monthly review process of the Corporation's financial information is not fully supported by evidence of such review. Questioned Costs: N/A Recommendation: We recommend management review/enhance its accounting and internal control procedures to ensure that all key accounts are reconciled and reviewed with supporting evidence of such review. Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding and will review the accounting and financial procedures, system of internal controls and policies. The Corporation has executed a new management agreement with Remnant Management Inc. effective October 1, 2024. Remnant Management Inc. will ensure that all transactions are properly recorded and that key accounts are reconciled and reviewed on a periodic basis beginning October 1, 2024 and going forward.
Information on the Federal Program(s): 10.760 Water and Waste Disposal Systems for Rural Communities, Department of Agriculture Compliance Requirements: Cash Management. Type of Finding: Material Noncompliance. Criteria: 2 CFR § 200.302(b)(6) requires that each non-Federal entity must provide for written procedures to implement the requirements of 2 CFR § 200.305 Payment. Condition: We noted that the City did not have written procedures to implement the requirements of 2 CFR § 200.305 Payment during fiscal year 2023. Cause: The City was not aware of the requirement to have written procedures to implement the requirements of 2 CFR § 200.305 Payment. Effect: Failure to have written procedures to ensure the compliance with the 2 CFR § 200.305 Payment could result in federal award drawdown requests by the City to be overstated as to immediate cash flow needs, noncompliance with Uniform Guidance requirements, and terms and conditions of the Federal award. Questioned Costs: There are no questioned costs. Recommendation: We recommend that the City identify grants that are subject to the Uniform Guidance on a timely basis to ensure all compliance requirements are met and develop written procedures where required. Views of Responsible Officials and Planned Corrective Action: The City has identified federal grants subject to the Uniform Guidance and will develop written procedures to implement the requirements of 2 CFR § 200.305 Payment.
Information on the Federal Program(s): 10.760 Water and Waste Disposal Systems for Rural Communities, Department of Agriculture Compliance Requirements: Allowable Costs and Costs Principles. Type of Finding: Material Noncompliance. Criteria: 2 CFR § 200.302(b)(7) requires that each non-Federal entity must provide for written procedures for determining the allowability of costs in accordance with 2 CFR 200 Subpart E – Cost Principles and the terms and conditions of the Federal award. Condition: We noted that the City did not have written procedures for determining the allowability of costs and the terms and conditions of the Federal award during fiscal year 2023. Cause: The City was not aware of the requirement to have written procedures for determining the allowability of costs and the terms and conditions of the Federal award. Effect: Failure to have written procedures for determining allowability of costs and the terms and conditions of the Federal award could result in costs charged to the program that are not allowable costs as defined by the appropriate cost principles circular and noncompliance with Uniform Guidance requirements and terms and conditions of the Federal award. Questioned Costs: There are no questioned costs. Recommendation: We recommend that the City identify grants that are subject to Uniform Guidance on a timely basis to ensure all compliance requirements are met and develop written procedures where required. Views of Responsible Officials and Planned Corrective Action: The City has identified federal grants subject to the Uniform Guidance and will develop written procedures for determining the allowability of costs in accordance with 2 CFR 200, Subpart E—Cost Principles and the terms and conditions of the Federal award.
2 CFR 1000.10 gives regulatory effect to the Department of Treasury for 2 CFR part 200.302. CFR 200.302(a) states, in part, the non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.302(b)(2) further states, in part, the financial management system of each non-Federal entity must provide for accurate, current, and complete disclosures of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. Additionally, the Ohio Department of Development (ODOD) Water and Wastewater Infrastructure Program Grant Agreement provides in Exhibit II that "Program reports must be submitted on a quarterly basis. Program reports must be submitted by close of business, on the second Friday at the end of each quarter.” Due to deficiencies in the City’s internal controls over reporting, the City did not submit quarterly program reports for any quarter in 2024. Failure to submit required quarterly program reports could result in the City not receiving the reimbursements that it is entitled to. The City should implement internal controls to ensure that reports are submitted by the required deadlines per reporting requirements.
FINDING 2023-004 – Cash Management: Significant Deficiency over Internal Controls over Compliance Assistance Listing Number Federal Agency/Pass-through Entity – Program Name Award Year Questioned Costs 64.033 VA Supportive Services for Veteran Families Program 2023 $0 Criteria: Regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Non-federal entities must establish written procedures to implement the requirements of 2 CFR section 200.305 ((2 CFR section 200.302(b)(6)). Non-federal entities must minimize the time elapsing between the transfer of funds from the US Treasury or pass-through entity and disbursement by the non-federal entity for direct program or project costs and the proportionate share of allowable indirect costs, whether the payment is made by electronic funds transfer, or issuance or redemption of checks, warrants, or payment by other means (2 CFR section 200.305(b)). The reimbursement payment method is the preferred payment method if (a) the non-federal entity cannot the meet the requirements in 2 CFR section 200.305(b)(1) for advance payment, (b) the federal awarding agency sets a specific condition for use of the reimbursement or (c) if requested by the non-federal entity (2 CFR sections 200.305(b)(3) and 200.208). Condition/Context: The Organization draws down funds based on a profit and loss report to signify the excess expenses incurred over the grant revenue. The Organization operates on a reimbursement basis. The request for reimbursements are not reviewed to ensure amounts have been paid with the Organization’s funds prior to the reimbursement request because certain expense codes do not relate to expenses paid but rather expenses incurred. Additionally, the frequency of draws during mid-months creates potential for errors when the reporting period has not been reconciled and therefore coded expenses are subject to change. Effect: Certain expenses included on the draw down total have not been paid for with Organization funds prior to the request or within 3 days of receipt of federal fund. Cause: There is no review to ensure the total only included expenses paid. Repeat finding: This is not a repeat finding. Recommendation: The Organization should reconcile program expenditures and requests for federal funds to ensure the total draw down is not in excess of disbursements paid by the Organization. Management should implement a review and approval process for reimbursement requests to verify that amounts drawn are supported by paid expenditures and appropriate documentation. Views of responsible officials and planned corrective actions: Management agrees with the recommendation and has developed a corrective action plan to address the finding.
Criteria: The Services and Transitional Housing for Trafficking Victims program requires that financial management procedures are followed for all federal awards in accordance with 2 CFR §200.302. Maintaining records that sufficiently identify the amount, source, and expenditure offederal funds for Federal awards. These records must contain information necessary to identifyfederal awards, authorizations, financial obligations, unobligated balances, as well as assets,expenditures, income, and interest. All records must be supported by source documentation. Condition: During the audit, it was noted that cash drawdowns, reimbursements, invoicing, and matching requirement reporting were performed without reconciliations to the general ledger consistently and lacked formal review and approval. Errors were identified in total expenses per the general ledger that did not agree to submitted reimbursement requests, and expenditure reporting could not be reconciled to the general ledger due to differences in reporting periods and incomplete supporting documentation. These observations demonstrate a lack of adequate internal controls over the recording, review, and approval of federal award transactions. Cause: The condition resulted from the accounting practices of the previously retained outsourced accounting firm in which internal controls over drawdowns, reimbursements, invoicing, SEFA reporting, and matching contributions were not formally established or enforced. Specifically, review, approval, and reconciliation procedures were not consistently followed, leading to errors and incomplete details. Additionally, management did not properly oversee the services to ensure these processes were properly being followed. Questioned Cost: $-0- Effect:Thelack offormalreview,approval,andreconciliation controls increasestheriskofinaccurate reportingoffederalexpenditures and matchingcontributions.The conditionrepresents a reportable deficiency thatcould resultin errors,misstatements,or noncompliancewith federalrequirements. Recommendation:Werecommendmanagementmaintain and enforceformalreviews, approvals,andreconciliation proceduresforalldrawdowns,reimbursements,invoicing,federalfinancialreporting,andmatchingcontributions.Managementshould ensure thatalltransactionsare consistently reconciledto thegeneralledger,adequately documented,and approvedpriortosubmission.Continuedmonitoring,periodic internalaudits,and stafftrainingshould beimplementedtopreventrecurrenceofdeficiencies. Classification:Compliancefindingandsignificantdeficiency in internalcontrols
2 CFR § 300 codified in 45 CFR part 75 gives regulatory effect to the Department of Health and Human Services. 2 CFR § 200.302(b)(6) states the financial management system of each non-Federal entity must provide for written procedures to implement the requirements of 2 CFR § 200.305 Payment. Additionally, for Federal awards, the Uniform Guidance requires a written policy for the procurement requirements outlined in 2 CFR § 200.318(c)(1), 2 CFR § 200.318(c)(2), and 2 CFR § 200.320(B) 2 CFR 200.302(b)(7) requires written procedures for determining the allowability of costs in accordance with Subpart E-Cost Principles of this part and the terms and conditions of the Federal award. 2 CFR 200.430 states that costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. 2 CFR 200.431 requires established written leave policies if the entity intends to pay fringe benefits. 2 CFR 200.464(a)(2) requires reimbursement of relocation costs to employees be in accordance with an established written policy must be consistently followed by the employer. 2 CFR 200.475 requires reimbursement and/or charges to be consistent with those normally allowed in like circumstances in the non-Federal entity's non-federally-funded activities and in accordance with non-Federal entity's written travel reimbursement policies. The General Health District did not have written policies as required by Uniform Guidance. The failure to implement written policies as required by Uniform Guidance could result in noncompliance with the District’s federal programs. The General Health District should adopt written policies in accordance with the Uniform Guidance.
FINDING 2023-002 Subject: CDBG - Entitlement Grants Cluster - Program Income Federal Agency: Department of Housing and Urban Development Federal Program: Community Development Block Grants/Entitlement Grants Assistance Listings Number: 14.218 Federal Award Numbers and Years (or Other Identifying Numbers): B-11-UN-18-0002, B-19-UC-18-0016, B-20-UC-18-0016, B-21-UC-18-0016, B-22-UC-18-0016, B-23-UC-18-0016 Compliance Requirement: Program Income Audit Findings: Material Weakness, Modified Opinion This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context The County received program income through various loan programs it offered to qualifying individuals. Once the County received a loan payment, the receipt was posted into the financial accounting system of the County and recorded in a grant fund. The amount received was also to be recorded in the Department of Housing and Urban Development's (HUD) Integrated Disbursement and Information System (IDIS) website. The recorded program income in the IDIS website would then appear on the Drawdown Report by Voucher Number report (PR07). One individual was responsible for notifying the County Auditor's office when program income money was received so it could be receipted in the County's financial accounting system. The same individual was also responsible for reporting the information on the IDIS site. No internal controls were established to ensure the program income that was recorded in the financial accounting system was also reported on the IDIS site and the PR07 report. There were 5 out of 38 receipts that were unable to be located on the PR07 report provided for audit. In addition, we were unable to verify the total amount recorded in the receipt ledger to the total reported on the PR07 report. The County's ledger amount was greater than the PR07 report by $54,727 and is primarily attributed to under reporting of program income in the IDIS as identified above. The lack of internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 20 LAKE COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.1 states in part: ". . . Internal controls for non-Federal entities means: (1) Processes designed and implemented by non-Federal entities to provide reasonable assurance regarding the achievement of objectives in the following categories: (i) Effectiveness and efficiency of operations; (ii) Reliability of reporting for internal and external use; . . ." 2 CFR 200.302 states in part: "(a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (b) The financial management system of each non-Federal entity must provide for the following: . . . (3) Records that identify adequately the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . ." 24 CFR 570.504 states in part: "(a) Recording program income. The receipt and expenditure of program income as defined in § 570.500(a) shall be recorded as part of the financial transactions of the grant program. (b) Disposition of program income received by recipients. (1) Program income received before grant closeout may be retained by the recipient if the income is treated as additional CDBG funds subject to all applicable requirements governing the use of CDBG funds. (2) If the recipient chooses to retain program income, that program income shall be disposed of as follows: INDIANA STATE BOARD OF ACCOUNTS 21 LAKE COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (i) Program income in the form of repayments to, or interest earned on, a revolving fund as defined in § 570.500(b) shall be substantially disbursed from the fund before additional cash withdrawals are made from the U.S. Treasury for the same activity. (This rule does not prevent a lump sum disbursement to finance the rehabilitation of privately owned properties as provided for in § 570.513.) (ii) Substantially all other program income shall be disbursed for eligible activities before additional cash withdrawals are made from the U.S. Treasury. . . ." Cause A turnover of staff in the County's Community Development office and management not ensuring that a system of internal controls that segregated key functions was designed, implemented, and operating effectively contributed to the program income issue identified above. Effect Without the proper implementation of an effectively designed system of internal controls, the County could not ensure that program income was properly reported and used before the drawdown of federal funds as required. The County could be at risk of losing federal funds by the federal awarding agency due to noncompliance with federal regulations. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the management of the County establish a system of internal controls to ensure that all program income received is properly reported in the IDIS system and expended prior to drawing down federal awards. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
Finding 2022-02 – Inability to Support Allowable Activities Program Number: 93.224, 93.225, 93.493, 93.527 Type of Finding: Internal Control, Compliance and Material Weakness Condition During our audit of compliance with federal requirements, we were unable to perform sufficient testing of allowable activities due to a significant lack of supporting documentation. Management was unable to provide adequate evidence demonstrating that expenditures and program activities were conducted in accordance with the terms and conditions of the federal award. Specifically: ▪ Documentation supporting program activities was not maintained or not provided upon request ▪ Only general ledger entries and limited journal supports were made available ▪ Supporting evidence of programmatic execution (e.g., participant records, activity reports, eligibility documentation, or service delivery evidence) was largely absent ▪ As a result, we could not determine whether expenditures were incurred for authorized program purposes This lack of documentation prevented us from verifying that funds were used for allowable activities under the federal program. Criteria Under 2 CFR 200.303 (Internal Controls) and 2 CFR 200.302 (Financial Management), nonfederal entities must maintain effective internal control over federal awards and provide accurate, current, and complete disclosure of financial results, supported by records that adequately demonstrate compliance. Additionally, program-specific requirements require that expenditures be incurred only for activities that are allowable and aligned with the objectives of the federal award. Cause These deficiencies appear to result from inadequate recordkeeping practices, lack of formal documentation requirements, and insufficient oversight of program-level activities. Management did not implement procedures to ensure that programmatic and financial documentation was retained and accessible for audit purposes. Effect Due to the absence of adequate documentation: ▪ We were unable to determine whether expenditures were used for allowable program activities
Finding 2022-03 – Inability to Support Allowable Costs and Cost Principles Federal Program Information Program Number: 93.224, 93.225, 93.493, 93.527 Type of Finding: Internal Control, Compliance and Material Weakness Condition During our audit, we were unable to perform sufficient testing of allowable costs and allocability due to inadequate and inconsistent supporting documentation. Management primarily provided journal entries and limited supporting invoices, with significant gaps in documentation necessary to support cost allowability, reasonableness, and allocability under federal requirements. Specifically: ▪ Supporting invoices and contracts were missing or incomplete for a significant portion of transactions ▪ Documentation supporting the nature, purpose, and benefit of costs to the federal program was not provided ▪ There was no evidence of cost allocation methodologies for shared or indirect costs ▪ Journal entries were recorded without adequate supporting detail or justification As a result, we were unable to determine whether costs charged to the federal program were allowable, reasonable, or allocable. Criteria Under 2 CFR 200.403 (Factors Affecting Allowability of Costs), costs must be: ▪ Necessary and reasonable ▪ Allocable to the federal award ▪ Adequately documented Further, 2 CFR 200.302(b)(3) requires that financial management systems provide records that identify adequately the source and application of funds, including supporting documentation for expenditures. Cause These deficiencies appear to result from weak internal controls over financial reporting and cost documentation, lack of formal procedures for maintaining supporting documentation, and insufficient understanding of Uniform Guidance cost principles. CARESTL HEALTH SCHEDULE OF FINDINGS AND QUESTIONED COSTS YEAR ENDED DECEMBER 31, 2022 40 SECTION III – FEDERAL AWARD FINDINGS AND QUESTION COSTS (Continued) Effect As a result: ▪ We were unable to verify the allowability and allocability of costs charged to the federal program ▪ There is a significant risk that unallowable or unsupported costs were charged to the award ▪ The organization is exposed to potential disallowance of costs, repayment obligations, and increased regulatory scrutiny The lack of documentation significantly impairs auditability and financial transparency Questioned Costs Likely Questioned Costs: Undeterminable due to insufficient documentation The inability to support costs charged to federal awards with adequate documentation constitutes a material weakness in internal control over compliance and results in noncompliance with Uniform Guidance cost principles. Recommendation We recommend that management: ▪ Implement procedures requiring complete supporting documentation for all costs charged to federal awards ▪ Ensure costs are reviewed for allowability, reasonableness, and allocability prior to recording ▪ Establish and document formal cost allocation methodologies ▪ Require approval and documentation of all journal entries affecting federal programs ▪ Provide training to staff on Uniform Guidance cost principles (2 CFR 200 Subpart E) ▪ Conduct periodic internal reviews to ensure compliance Management Response Management respectfully disagrees with the characterization of a material weakness related to the inability to support allowable costs and cost principles. The four cited conditions do not reflect a lack of documentation or internal controls, but rather the limited time afforded to the health center to compile and submit the requested materials. The HRSA mandated April 30, 2026 deadline, during a period of significant operational strain. As a result, the health center was not provided a reasonable opportunity to gather and produce the full set of supporting documentation. CARESTL HEALTH SCHEDULE OF FINDINGS AND QUESTIONED COSTS YEAR ENDED DECEMBER 31, 2022 41 SECTION III – FEDERAL AWARD FINDINGS AND QUESTION COSTS (Continued) Specifically, we disagree with the following statements: • “Supporting invoices and contracts were missing or incomplete for a significant portion of transactions.” The health center maintains invoices, contracts, and supporting documentation; however, due to the compressed audit timeline and competing federal deadlines, staff were unable to assemble and transmit the full set of documents before the cutoff. • “Documentation supporting the nature, purpose, and benefit of costs to the federal program was not provided.” Documentation exists within our financial management system and program files. The inability to provide it during fieldwork was due to time constraints, not the absence of records. • “There was no evidence of cost allocation methodologies for shared or indirect costs.” Cost allocation methodologies are in place and were included in the financial management response submitted to HRSA. The audit team did not receive these materials because the request coincided with overlapping federal reporting requirements and limited staffing capacity. • “Journal entries were recorded without adequate supporting detail or justification.” Supporting detail for journal entries is maintained internally. The challenge was not lack of documentation but insufficient time to compile and submit the supporting files during the abbreviated fieldwork window. • While we disagree with the stated conditions, we fully agree with all recommendations and view them as aligned with the improvements already underway as part of our financial management corrective actions submitted to HRSA. Management is committed to strengthening documentation practices, enhancing internal controls, and ensuring full compliance with Uniform Guidance. • Accordingly, the health center will: o Implement procedures requiring complete supporting documentation for all costs charged to federal awards o Ensure costs are reviewed for allowability, reasonableness, and allocability prior to recording o Establish and document formal cost allocation methodologies o Require approval and documentation of all journal entries affecting federal programs o Provide staff training on Uniform Guidance cost principles (2 CFR 200 Subpart E) o Conduct periodic internal reviews to ensure compliance These actions are already in progress and will be fully integrated into the organization’s financial management and internal control framework.
Finding 2023-012—Subrecipient Monitoring Material Weakness Federal Program: All federal awards. Criteria: Under 2 CFR 200.302(b), the entity must maintain internal controls to ensure tracking, collection, and resolution of amounts owed by subrecipients (e.g., repayments, questioned costs, overpayments, or unallowable costs). In addition, under 2 CFR 200.331(d) and 200.332, pass-through entities must: • Monitor subrecipient activities to ensure federal funds are used for authorized purposes. • Ensure subrecipients take timely and appropriate action on deficiencies, including financial issues. • Review financial and performance reports. Finding 2023-012—Subrecipient Monitoring (Continued) • Verify that subrecipients have audits as required; follow up on any audit findings or amounts due to the pass-through entity. Condition: During our audit of IFDC’s subrecipient monitoring procedures, we identified that IFDC did not provide the support of the subgrantee annual reports and evidence of timely follow up. Cause: IFDC does not have formal written procedures requiring appropriate monitoring procedures to ensure that subrecipients are providing the necessary documentation for appropriate risk assessment and monitoring. Effect: Noncompliance with 2 CFR 200.331. In addition, there is weak oversight of federal funds passed through to subrecipients and potential material misstatement of subrecipient expenditures on the Schedule of Expenditures of Federal Awards (SEFA). Questioned costs: None noted. Context: IFDC passed through approximately $5 million to 25 subrecipients during the fiscal year and there was no evidence of timely receipt of the annual audits of each subrecipient. Management provided emails showing there was communication but there is no formal policy to require timely follow up and appropriate documentation. Repeat Finding: No Recommendation: IFDC should establish formal policies and procedures for subrecipient risk assessment and monitoring under 2 CFR 200.331. Views of responsible officials and planned corrective actions: Management agrees with the finding. See corrective action plan.
Federal Agency: U.S. Department of the Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds (Eviction Rental Assistance Program 2.0) Assistance Listing Number: 21.027 Federal Award Identification Number and Year: SLFRP0002 2022 Pass-Through Agency: Washington State Department of Commerce Pass-Through Number(s): 21-4619C-104 Award Period: 10/1/2021 - 6/30/2023 Type of Finding: Significant Deficiency in Internal Control over Compliance and Compliance Criteria or specific requirement: Uniform Guidance 2 CFR §200.302(b) requires non‑Federal entities to maintain effective control over and accountability for Federal awards, including accurate financial reporting. In addition, 2 CFR §200.303(a) requires the auditee to establish and maintain effective internal control over Federal awards that provides reasonable assurance that the entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The grant agreement with the Washington State Department of Commerce further requires that reimbursement requests be submitted in accordance with the approved budget and cost categories. Condition: The client submitted reimbursement requests to the Washington State Department of Commerce using Form 19‑1A; however, the budget line items reported on the Form 19‑1A did not agree to the approved grant budget in all instances tested. Specifically, while the underlying expenditures were allowable and incurred in accordance with the grant agreement, the budget line items selected on the Form 19‑1A were incorrect in every instance tested, resulting in inaccurate budget category reporting to the pass‑through entity. Context: None of Form 19-1A's contain accurate budget line items do not align with the grant or its amendments. Cause: The auditee did not have adequate internal controls in place to ensure that expenditures were consistently and accurately mapped to the correct budget line items when preparing Form 19‑1A reimbursement requests. Specifically, there was no documented review or reconciliation process to verify that the budget categories selected on the Form 19‑1A agreed to the approved grant budget prior to submission. Effect: As a result of this control deficiency, reimbursement requests submitted to the pass‑through entity did not accurately reflect budgeted cost categories, which increases the risk of noncompliance with the terms of the grant agreement. While the costs tested were determined to be allowable, the inaccurate budget allocation could result in improper reporting, increased scrutiny from the grantor, or potential disallowed costs if not corrected. No questioned costs were identified as the expenditures tested were allowable and supported. Repeat Finding: No. Recommendation: We recommend that the auditee implement procedures to ensure that Form 19‑1A reimbursement requests are reviewed prior to submission to confirm that expenditures are charged to the correct approved budget line items. This may include maintaining a reconciliation between the general ledger, the approved grant budget, and the Form 19‑1A, as well as implementing supervisory review and approval of reimbursement submissions. Views of responsible officials: Management agrees with the finding and has prepared a Corrective Action Plan.
Finding 2023-001: 10.561 - State Administrative Matching Grants for the Supplemental Nutrition Assistance Program - Material Weakness Compliance Requirement: Allowable Costs/Cost Principles Criteria: Uniform Guidance requires non-Federal entities to maintain records that adequately identify the source and application of funds for federally funded activities. Specifically, 2 CFR §200.302(b)(3) requires accounting records to be supported by source documentation. In addition, 2 CFR §200.403(a) and §200.403(g) require that costs charged to a Federal award be allowable, adequately documented, and in accordance with generally accepted accounting principles. Condition: The Organization did not record or track actual direct costs to the grant. Instead, estimated costs were used to allocate expenses to the program. The Organization could not provide support of the underlying source documentation demonstrating that the costs were incurred, allowable, and directly attributable to the grant. Effect: Because costs charged to the program were based on estimates rather than actual expenditures supported by source documentation, the Organization was unable to demonstrate compliance with Uniform Guidance requirements. As a result, the entire program cost of $124,895 was determined to be a questioned cost. Questioned Cost: $124,895 Cause: The Organization adequate procedures and internal controls to ensure that actual, supportable direct costs were charged to the grant. Recommendation: We recommend that the Organization implement policies and procedures to ensure that actual, allowable, and properly documented direct costs are charged to Federal awards. This should include strengthening internal controls over grant accounting, ensuring costs are supported by source documentation, and providing training to personnel responsible for grant financial reporting. The Organization should also work with the grantor to determine the allowability of the questioned costs and take corrective action as required. Response: There is no disagreement with the audit finding.
COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) – Federal Assistance Listing Number 20.027 Condition: We noted one disbursement of grant funds supported by a claim form with only one source of approval. Another disbursement was supported by a claim form with only one source of approval and the check issued was signed by only one authorized signer. Criteria: 2 CFR 200.303(a) states the non-Federal entity must establish and maintain effective internal control over the Federal award. Also, CFR 200.302(b)(3) states the financial management system of each non-Federal entity must provide records that identify adequately, among other things, proper authorizations. Cause: Internal controls over cash disbursements were overridden. The County’s policy is to require two signatures on all checks, as well as a completed claim form which is approved by a department head, the county clerk, and a member of the claims committee. Effect: Unauthorized or improper use of grant funds could occur. Context: A total of thirteen disbursements was selected for testing, which was 100% of the population. The use of grant funds for the purpose of these disbursements was previously approved by the county board. Therefore, there are no questioned costs. Recommendation: Management should follow the internal control policies in effect for the disbursement of other County funds in the disbursement of CSLFRF grant funds. Views of Responsible Officials and Planned Corrective Actions: Management will follow controls implemented over approving claim forms and signing checks for other County disbursements for CSLFRF grant disbursements.
COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) – Federal Assistance Listing Number 20.027 Condition: We noted one disbursement of grant funds supported by a claim form with only one source of approval. Another disbursement was supported by a claim form with only one source of approval and the check issued was signed by only one authorized signer. Criteria: 2 CFR 200.303(a) states the non-Federal entity must establish and maintain effective internal control over the Federal award. Also, CFR 200.302(b)(3) states the financial management system of each non-Federal entity must provide records that identify adequately, among other things, proper authorizations. Cause: Internal controls over cash disbursements were overridden. The County’s policy is to require two signatures on all checks, as well as a completed claim form which is approved by a department head, the county clerk, and a member of the claims committee. Effect: Unauthorized or improper use of grant funds could occur. Context: A total of thirteen disbursements was selected for testing, which was 100% of the population. The use of grant funds for the purpose of these disbursements was previously approved by the county board. Therefore, there are no questioned costs. Recommendation: Management should follow the internal control policies in effect for the disbursement of other County funds in the disbursement of CSLFRF grant funds. Views of Responsible Officials and Planned Corrective Actions: Management will follow controls implemented over approving claim forms and signing checks for other County disbursements for CSLFRF grant disbursements.
2023-003 REPORTING Federal Program Information: Federal Agency and Program Name Federal Assistance Listing Number National Endowment for the Humanities Promotion of the Humanities Federal/State Partnership Grant Number: SO-289836-23 45.129 Criteria: 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.302(b) states that “the financial management system of each non-Federal entity must provide for… accurate, current, and complete disclosure of the financial results of each Federal award or program…” Condition: For both of the SF-425 reports selected for testing, there was no documentation of review and approval of the SF-425 report prior to submission. For one of the SF-425 reports selected for testing, inaccurate data was input and submitted. Questioned Costs: None Context: Total federal expenditures for the Promotion of the Humanities Federal/State Partnership program were $1,019,055 for the year ended October 31, 2023. Cause: The Council does not have adequate internal controls and policies and procedures in place to ensure that reports contain accurate financial information and are reviewed before submission. Effect: The Council is not reporting accurate financial information to its federal grantor. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Council implement controls and policies and procedures over financial reporting to ensure compliance with federal reporting requirements. Views of Responsible Officials: Management acknowledges the finding. See corrective action plan.
2023-003 REPORTING Federal Program Information: Federal Agency and Program Name Federal Assistance Listing Number National Endowment for the Humanities Promotion of the Humanities Federal/State Partnership Grant Number: SO-289836-23 45.129 Criteria: 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.302(b) states that “the financial management system of each non-Federal entity must provide for… accurate, current, and complete disclosure of the financial results of each Federal award or program…” Condition: For both of the SF-425 reports selected for testing, there was no documentation of review and approval of the SF-425 report prior to submission. For one of the SF-425 reports selected for testing, inaccurate data was input and submitted. Questioned Costs: None Context: Total federal expenditures for the Promotion of the Humanities Federal/State Partnership program were $1,019,055 for the year ended October 31, 2023. Cause: The Council does not have adequate internal controls and policies and procedures in place to ensure that reports contain accurate financial information and are reviewed before submission. Effect: The Council is not reporting accurate financial information to its federal grantor. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Council implement controls and policies and procedures over financial reporting to ensure compliance with federal reporting requirements. Views of Responsible Officials: Management acknowledges the finding. See corrective action plan.
S3800-010 Finding Reference Number – 2023-002 S3800-011 Title and CFDA Number of Federal Program – Section 232 Loan – Mortgage Insurance Nursing Homes, Intermediate Care Facilities, Board and Care Homes and Assisted Living Facilities Loan, ALN 14.129 S3800-015 Type of Finding – Federal Award Finding Other Matters S3800-016 Finding Resolution Status – In progress S3800-017 Information on Universe Population Size – 1,710 checks and bank transfers, all disbursements from bank accounts. S3800-018 Sample Size Information – Sample size was 49 disbursements. Errors were found on 2 out of the 49 disbursements tested. S3800-019 Identification of Repeat Finding and Finding Reference Number – N/A S3800-020 Criteria – Per 2 CFR sections 200.302 and 200.303 of the Uniform Guidance, an entity must establish and maintain effective internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. Allowable cost controls of Cheney Care Community require general ledger account coding to be written on each invoice to be reviewed by the Executive Director before the invoice is processed to be paid. S3800-030 Statement of Condition – During our audit, we noted two invoices that did not include the general ledger account coding on the invoices, as required by Cheney Care Community’s allowable cost controls. The invoices were recorded to the proper general ledger accounts. S3800-032 Cause – Cheney Care Community did not follow their documented internal controls over financial reporting and allowable costs to ensure general ledger coding is included on each invoice for review and approval. S3800-033 Effect or Potential Effect – Failure to maintain effective internal controls over compliance with federal requirements increases the risk of unauthorized or unallowable transactions occurring. S3800-035 Auditor Non-Compliance Code – S (Internal Controls) S3800-037 FHA/Contract Number – 171-22029 S3800-038 Questioned Costs – $0 S3800-040 Questioned Costs – $0 S3800-045 Reporting Views of Responsible Officials – Cheney Care Community is in agreement with the findings, and the recommendations have been implemented. S3800-050 Context – A sample of 49 checks totaling $206,327 was selected for audit from a population of 1,710 checks totaling $11,294,298. The test found two checks that were not in compliance with Cheney Care Community’s allowable cost controls totaling $93. The invoices were recorded to the proper general ledger accounts. Our sample was a statistically valid sample. S3800-080 Recommendation – We recommend management of Cheney Care Community review their internal controls over the cash disbursement process with the necessary individuals involved in the process to ensure the implementation of general ledger account coding on cash disbursements is consistently performed going forward. S3800-090 Auditor’s Summary of Auditee Comments on the Findings and Recommendations – The Executive Director and A/P Clerk agreed upon using certain general ledger account codes consistently for similar purchases from the same vendor. In Cheney Care Community’s accounting system, these agreed upon general ledger account codes have been pre-set as a default for certain vendors. When invoices are received that should be appropriately coded to this default general ledger account code, errors of not documenting the general ledger account code on the invoice are periodically made. Cheney Care Community will consistently perform the general ledger account coding internal control procedures on invoices going forward. S3800-130 Response Indicator – Agree S3800-140 Completion Date – September 30, 2024 S3800-150 Response – Cheney Care Community will consistently perform the general ledger account coding internal control procedures on invoices going forward.
S3800-010 Finding Reference Number – 2023-002 S3800-011 Title and CFDA Number of Federal Program – Section 202 Supportive Housing for the Elderly, Capital Advance and Project Rental Assistance Contract, ALN 14.157 S3800-015 Type of Finding – Federal Award Finding; Other Matters S3800-016 Finding Resolution Status – In progress S3800-017 Information on Universe Population Size – 202 checks and bank transfers, all disbursements from bank accounts S3800-018 Sample Size Information – Sample size was 40 disbursements. Errors were found on 1 out of the 40 disbursements tested. S3800-019 Identification of Repeat Finding and Finding Reference Number – N/A S3800-020 Criteria – Per 2 CFR sections 200.302 and 200.303 of the Uniform Guidance, an entity must establish and maintain effective internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. Allowable cost controls of Sessions Village 202 require general ledger account coding to be written on each invoice to be reviewed by the Executive Director before the invoice is processed to be paid. S3800-030 Statement of Condition – During our audit, we noted one invoice that did not include the general ledger account coding on the invoice, as required by Sessions Village 202’s allowable cost controls. The invoice was recorded to the proper general ledger account. S3800-032 Cause – Sessions Village 202 did not follow their documented internal controls over financial reporting and allowable costs to ensure general ledger coding is included on each invoice for review and approval. S3800-033 Effect or Potential Effect – Failure to maintain effective internal controls over compliance with federal requirements increases the risk of unauthorized or unallowable transactions occurring. S3800-035 Auditor Non-Compliance Code – S (Internal Controls) S3800-037 FHA/Contract Number – 171-EE015 S3800-038 Questioned Costs – $0 S3800-040 Questioned Costs – $0 S3800-045 Reporting Views of Responsible Officials – Sessions Village 202 is in agreement with the findings, and the recommendations have been implemented. S3800-050 Context – A sample of 40 checks totaling $41,900 was selected for audit from a population of 202 checks totaling $186,253. The test found one check that was not in compliance with Sessions Village 202’s allowable cost controls totaling $369. The invoice was recorded to the proper general ledger account. Our sample was a statistically valid sample. S3800-080 Recommendation – We recommend management of Sessions Village 202 review their internal controls over the cash disbursement process with the necessary individuals involved in the process to ensure the implementation of general ledger account coding on cash disbursements is consistently performed going forward. S3800-090 Auditor’s Summary of Auditee Comments on the Findings and Recommendations – The Executive Director and A/P Clerk agreed upon using certain general ledger account codes consistently for similar purchases from the same vendor. In Sessions Village 202’s accounting system, these agreed upon general ledger account codes have been pre-set as a default for certain vendors. When invoices are received that should be appropriately coded to this default general ledger account code, errors of not documenting the general ledger account code on the invoice are periodically made. Sessions Village 202 will consistently perform the general ledger account coding internal control procedures on invoices going forward. S3800-130 Response Indicator – Agree S3800-140 Completion Date – September 30, 2024 S3800-150 Response – Sessions Village 202 will consistently perform the general ledger account coding internal control procedures on invoices going forward.
S3800-010 Finding Reference Number – 2023-002 S3800-011 Title and CFDA Number of Federal Program – Section 202 Supportive Housing for the Elderly, Capital Advance and Project Rental Assistance Contract, ALN 14.157 S3800-015 Type of Finding – Federal Award Finding; Other Matters S3800-016 Finding Resolution Status – In progress S3800-017 Information on Universe Population Size – 202 checks and bank transfers, all disbursements from bank accounts S3800-018 Sample Size Information – Sample size was 40 disbursements. Errors were found on 1 out of the 40 disbursements tested. S3800-019 Identification of Repeat Finding and Finding Reference Number – N/A S3800-020 Criteria – Per 2 CFR sections 200.302 and 200.303 of the Uniform Guidance, an entity must establish and maintain effective internal control over the federal awards that provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations and terms and conditions of the federal award. Allowable cost controls of Sessions Village 202 require general ledger account coding to be written on each invoice to be reviewed by the Executive Director before the invoice is processed to be paid. S3800-030 Statement of Condition – During our audit, we noted one invoice that did not include the general ledger account coding on the invoice, as required by Sessions Village 202’s allowable cost controls. The invoice was recorded to the proper general ledger account. S3800-032 Cause – Sessions Village 202 did not follow their documented internal controls over financial reporting and allowable costs to ensure general ledger coding is included on each invoice for review and approval. S3800-033 Effect or Potential Effect – Failure to maintain effective internal controls over compliance with federal requirements increases the risk of unauthorized or unallowable transactions occurring. S3800-035 Auditor Non-Compliance Code – S (Internal Controls) S3800-037 FHA/Contract Number – 171-EE015 S3800-038 Questioned Costs – $0 S3800-040 Questioned Costs – $0 S3800-045 Reporting Views of Responsible Officials – Sessions Village 202 is in agreement with the findings, and the recommendations have been implemented. S3800-050 Context – A sample of 40 checks totaling $41,900 was selected for audit from a population of 202 checks totaling $186,253. The test found one check that was not in compliance with Sessions Village 202’s allowable cost controls totaling $369. The invoice was recorded to the proper general ledger account. Our sample was a statistically valid sample. S3800-080 Recommendation – We recommend management of Sessions Village 202 review their internal controls over the cash disbursement process with the necessary individuals involved in the process to ensure the implementation of general ledger account coding on cash disbursements is consistently performed going forward. S3800-090 Auditor’s Summary of Auditee Comments on the Findings and Recommendations – The Executive Director and A/P Clerk agreed upon using certain general ledger account codes consistently for similar purchases from the same vendor. In Sessions Village 202’s accounting system, these agreed upon general ledger account codes have been pre-set as a default for certain vendors. When invoices are received that should be appropriately coded to this default general ledger account code, errors of not documenting the general ledger account code on the invoice are periodically made. Sessions Village 202 will consistently perform the general ledger account coding internal control procedures on invoices going forward. S3800-130 Response Indicator – Agree S3800-140 Completion Date – September 30, 2024 S3800-150 Response – Sessions Village 202 will consistently perform the general ledger account coding internal control procedures on invoices going forward.
2023-005 Internal Controls over Grant Management (Significant Deficiency and Noncompliance) Criteria: 2 CFR 200.302 establishes the requirements of a financial management system adequate to ensure compliance with federal regulations. This system must include written procedures to implement requirements for payment methods and determine the allowability of costs in accordance with subpart E. Statement of Condition: The City has written fiscal policies but they do not meet the financial management system requirements established in the regulations. Cause: The City has processes and procedures in place to administer grant funds but written policies do not contain compliance requirements. Effect: The City is not in compliance with financial management system requirements. Recommendation: The City should develop a grants manual or additional written policies to incorporate all the requirements of 2 CFR 200 and ensure compliance. Views of Management and Planned Corrective Action: See Corrective Action Plan included at the end of the report.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.
Finding 2023‐001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 below, exhibited the following U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302‐303 (“Section 200.302‐303”) is required for all federal awards. Section 200.302‐303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and amounts reported on the schedule of expenditures of federal awards (SEFA) in accordance with Section 200.302‐303 were not appropriately designed and implemented, or operated, effectively. Specifically, during the 2023 audit, the following conditions were identified: In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements For five out of 40 National Institute of Health salary cap selections related to special tests and provisions, the monthly review of the summary report by grant activity was not adequately and consistently performed. The summary report is editable by end users and the review performed was not precise enough to identify formula errors in the calculations; or key personnel who were incorrectly excluded from the report. The review of indirect costs and fringe benefits on the SPA intake form was not precise enough to identify errors in a timely manner. The SPA form includes key grant data and is used in the initial setup of new grants to input indirect cost and fringe benefit rates in the general ledger system. For two out of 16 selections of indirect costs and fringe benefit amounts errors were not identified on a timely basis and were corrected in a subsequent period. The review and preparation of the SEFA for R&D grants was not timely and precise enough to ensure accuracy. This resulted in a lack of accuracy of grant award information presented on the SEFA; as well as the inclusion of grant expenses pertaining to prior fiscal periods on the current year’s SEFA since they were not identified timely in the prior years. Approximately $39 thousand in R&D expenditures related to prior fiscal years was included on the 2023 SEFA as they were not identified timely in prior fiscal years. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302‐303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that are highly susceptible to human error. Reviews were not performed a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The delay in completing the September 30, 2023, Uniform Guidance audit procedures as well as the deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. Policies and procedures should be developed, documented and maintained/updated for all significant grant‐related activities. On‐going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. Controls should be implemented consistently to facilitate a timely review of indirect cost and fringe benefit rates at the initial set‐up of the activity within the general ledger. A more thorough closing process should be performed to review information included on the SEFA and to record grant‐related expenses timely to minimize the risk of recognizing out‐of‐period expenses for SEFA reporting.