Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
2024-001 Report Review and Approval Federal Agency: U.S Department of Treasury Federal Program Name: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Identification Number and Year: SLFRP0125 2022 Pass-through Agency: Florida Department of Environmental Protection Award Period: January 30, 2023 through December 31, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: Compliance: 2 CFR 200.302(b)(3) states that records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the ”Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: It was observed that quarterly progress reports lacked documentation of review and approval by management prior to submission. Questioned Costs: None. Context: Two of two quarterly progress reports selected for testing lacked documented review and approval. Cause: The lack of review and approval of grant quarterly progress report submissions may be attributed to insufficient training of staff on the importance of the review process, inadequate staffing levels, or a lack of clear guidelines and procedures for the review and approval process. Effect: The lack of a proper review and approval process for grant quarterly progress report submissions can result in the submission of inaccurate and incomplete reimbursement requests and reports, which may lead to non-compliance with grant requirements and potential financial penalties. Repeat Finding: No Recommendation: We recommend that the organization implement a review and approval process for all quarterly progress report submissions. This should include: - Training staff on the importance of the review and approval process. - Ensuring adequate staffing levels to handle the review process. - Developing clear guidelines and procedures for the review and approval process. - Regularly monitoring and auditing the review process to ensure compliance. View of Responsible Official and Planned Corrective Actions: Management concurs with the auditor’s recommendations. Additional fiscal staff has been hired to assist with various fiscal tasks including grant compliance and reporting. The guidelines are being updated, the checklist expanded, and documentation of secondary approval of reports is being retained. Grant guidelines, procedures, and checklists will be utilized to ensure compliance is maintained.
2024-001 Report Review and Approval Federal Agency: U.S Department of Treasury Federal Program Name: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Identification Number and Year: SLFRP0125 2022 Pass-through Agency: Florida Department of Environmental Protection Award Period: January 30, 2023 through December 31, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: Compliance: 2 CFR 200.302(b)(3) states that records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the ”Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: It was observed that quarterly progress reports lacked documentation of review and approval by management prior to submission. Questioned Costs: None. Context: Two of two quarterly progress reports selected for testing lacked documented review and approval. Cause: The lack of review and approval of grant quarterly progress report submissions may be attributed to insufficient training of staff on the importance of the review process, inadequate staffing levels, or a lack of clear guidelines and procedures for the review and approval process. Effect: The lack of a proper review and approval process for grant quarterly progress report submissions can result in the submission of inaccurate and incomplete reimbursement requests and reports, which may lead to non-compliance with grant requirements and potential financial penalties. Repeat Finding: No Recommendation: We recommend that the organization implement a review and approval process for all quarterly progress report submissions. This should include: - Training staff on the importance of the review and approval process. - Ensuring adequate staffing levels to handle the review process. - Developing clear guidelines and procedures for the review and approval process. - Regularly monitoring and auditing the review process to ensure compliance. View of Responsible Official and Planned Corrective Actions: Management concurs with the auditor’s recommendations. Additional fiscal staff has been hired to assist with various fiscal tasks including grant compliance and reporting. The guidelines are being updated, the checklist expanded, and documentation of secondary approval of reports is being retained. Grant guidelines, procedures, and checklists will be utilized to ensure compliance is maintained.
Finding 2024-001: Preparation of Schedule of Expenditures of Federal Awards (SEFA) Program Name: Multiple federal programs Criteria 1. The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. (b) The recipient’s and subrecipient’s financial management system must provide for the following: (1) Identification of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number, year the Federal award was issued, and name of the Federal agency or pass-through entity. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in § 200.328 and § 200.329. When a Federal agency or pass-through entity requires reporting on an accrual basis from a recipient or subrecipient that maintains its records other than on an accrual basis, the recipient or subrecipient must not be required to establish an accrual accounting system. This recipient or subrecipient may develop accrual data for its reports based on an analysis of the documentation on hand. 2. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. After the completion of internal review and approval process that Amtrak has established for SEFA preparation and review, we have received multiple updated versions of the schedule with changes to FY24 expenditure amounts for three Assistance Listings included on the SEFA. Total expenditures increased by $80.2 million from version 1 to the final version received. 2. The starting point of the SEFA preparation for the current year was not the audited FY23 SEFA submitted to Federal Audit Clearinghouse, as we have identified that Amtrak subsequently made changes to the FY23 internal SEFA document without reconciling the changes to the audited FY23 SEFA, which resulted in the total cumulative expenditures as of 9/30/2023 to be updated and as such impacting the FY24 expenditures for the respective federal programs. One of the adjustments related to the Hudson Yards Concrete Casing project (HYCC-3) which initially incorrectly recorded $25.0 million of prepaid expenditures. 3. As Assistance Listing #20.314 has been obligated as of 9/27/2024, Amtrak has recorded expenditures related to the HYCC-3 project under this program for the established pre-award period, which dated from January 30, 2023 as part of the FY24 expenditures. Previously, a portion of the total expenditures was included within the FY23 SEFA under Assistance Listing #20.315, for the total amount of $15.6 million. This amount was not adjusted out of the cumulative expenditures for Assistance Listing #20.315 until 2025. Consequently, these expenditures were listed both within the FY23 SEFA under Assistance Listing #20.315 and under the FY24 SEFA as Assistance Listing #20.314 expenditures. 4. As part of SEFA preparation as it relates to allocation of operating expenditures across multiple funding sources, certain projects were incorrectly mapped to annual grants funding source, which resulted in approximately $0.3 million of operating expenses to be included within Assistance Listing #20.315 that were also reported under Assistance Listing #97.075. Cause Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not operating in a manner that would timely identify the conditions noted. Additionally, Amtrak’s controls around allocation of federal funding to project codes were not designed in a manner that would timely identify the conditions noted. In reviewing management’s controls around the SEFA preparation, the design of key controls identified by management does not include an overarching review of the SEFA and reconciliation of what’s been reported on the SEFA from individual projects’ standpoint when such projects have multiple assistance listings as funding sources. We also noted that there was not a specific control that ensures timely updates of Work Breakdown Structure (WBS) funding assignments and allocations when there is a change such as a new grant agreement signed. Effect Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not designed in such a manner that would timely identify the conditions noted, which resulted in several versions of the SEFA that were erroneous and inclusion of expenditures that were double counted within the SEFA. This puts Amtrak at greater risk of non-compliance with its grant agreements with respect to questioned costs and an inaccurate SEFA. Questioned Costs None. Context The SEFA, as originally provided, had exceptions as described in the Condition section above noted for matters 1 and 2 in the Criteria section above, indicating that certain internal controls were not functioning as designed and others were not designed effectively. Identification as a Repeat Finding Not a repeat finding. Recommendation We recommend Amtrak to strengthen the SEFA oversight process to ensure appropriate preparation and review of the SEFA to validate its accuracy, including reconciliation with prior year audited SEFA. This should include having one reviewer take overall responsibility for the completeness and accuracy of the final submitted SEFA. This robust review process should include appropriate procedures to confirm accuracy of the SEFA, which may include a protocol where representatives from various groups (both discretionary and non-discretionary federal programs) work collaboratively to review the SEFA and underlying details of expenditures, to ensure all the adjustments have been properly reflected as well as any projects that might have multiple fund sources are identified timely and reviewed for appropriate inclusion within the SEFA. Additionally, Amtrak should establish a process where any modifications of WBS funding assignments and allocations are updated in a timely manner. Views of Responsible Officials Amtrak recognizes the need to improve the preparation and review of the SEFA. The company has documented the steps for preparing and reviewing the SEFA within its process narrative. The company will update the narrative to address the preparation and review issues that led to the multiple versions of the SEFA being provided during the audit. The company will review and update the Grants Management Compliance Narrative and controls to improve timing of updates for modifications of WBS funding assignments. The company is in the process of updating the SEFA preparation documentation for FY2025, which will be used at the end of the year. The review procedures and controls are being enhanced to include a checklist to improve the review.
Finding 2024-002: Review of Compliance Matrices and Narratives Program Name: 1. Rail and Transit Security Grant Program Assistance Listing No. 97.075 2. Railroad Development Assistance Listing No. 20.314 Federal Award No.: 1. EMW-2022-RA-00032 EMW-2021-RA-00048 EMW-2020-RA-00014 2. 69A36524400010MEGDC Federal Agency: 1. U.S. Department of Homeland Security 2. U.S. Department of Transportation Criteria The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. For the compliance matrix that is maintained for the Assistance Listing #97.075, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. Additionally, we noted that two provisions that were present in the grant agreements were not included in the matrix. 2. For the compliance matrix that is maintained for the Assistance Listing #20.314, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. 3. Specific compliance requirements as it relates to the earmarking provisions of the respective grants of the Assistance Listing #97.075 were not detailed out within the respective compliance matrix, nor within the compliance narrative that is documented by Amtrak to assess the applicability and relevance of individual compliance requirements contained within the Compliance Supplement. Cause In reviewing management’s controls, the key controls identified by management are not designed such that consistent and timely proactive monitoring and/or review occurs to ensure that all the compliance requirements and any changes to the wording of specific provisions are updated and reviewed within the compliance matrices and the compliance narrative. Effect Amtrak is not in compliance with the 2 CFR 200.302 (a) and 2 CFR 200.303. This may also put Amtrak at greater risk of non-compliance with specific provisions in accordance with the federal awards. Questioned Costs None. Context We have reviewed the federal awards in scope and the compliance matrices and compliance narrative maintained by the Company as part of the audit procedures in connection with testing of earmarking and special tests and provisions compliance requirements. Identification as a Repeat Finding Not a repeat finding. However, we have noted similar control deficiencies related to completeness of the compliance matrices in prior years. Recommendation We recommend that Amtrak establishes a more defined timeline for the events that would trigger the update and review of the compliance matrices and compliance narrative, which could include execution of any new federal awards or amendments to existing federal awards. Additionally, Amtrak should establish a process where the modifications to the provisions are assessed for materiality/applicability and include documentation of the respective conclusions as part of the review process. Views of Responsible Officials Amtrak acknowledges the need to augment process documentation around the controls over the preparation and updates to the compliance matrices. The company is in the process of updating these controls now and will incorporate the identified findings in developing more robust controls. The company specifically notes the need to add more documentation on considerations for what provisions are updated in the compliance matrices and the evidence of review. The review procedures and controls are being enhanced to include a checklist to improve the review. This checklist will be completed by both the compliance matrix creator (upon creation) and the compliance matrix reviewer/approver (upon review and final approval).
Finding 2024-002: Review of Compliance Matrices and Narratives Program Name: 1. Rail and Transit Security Grant Program Assistance Listing No. 97.075 2. Railroad Development Assistance Listing No. 20.314 Federal Award No.: 1. EMW-2022-RA-00032 EMW-2021-RA-00048 EMW-2020-RA-00014 2. 69A36524400010MEGDC Federal Agency: 1. U.S. Department of Homeland Security 2. U.S. Department of Transportation Criteria The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. For the compliance matrix that is maintained for the Assistance Listing #97.075, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. Additionally, we noted that two provisions that were present in the grant agreements were not included in the matrix. 2. For the compliance matrix that is maintained for the Assistance Listing #20.314, we have identified that for nine provisions, the wording contained withing the matrix did not match in its entirety to the respective grant agreement. 3. Specific compliance requirements as it relates to the earmarking provisions of the respective grants of the Assistance Listing #97.075 were not detailed out within the respective compliance matrix, nor within the compliance narrative that is documented by Amtrak to assess the applicability and relevance of individual compliance requirements contained within the Compliance Supplement. Cause In reviewing management’s controls, the key controls identified by management are not designed such that consistent and timely proactive monitoring and/or review occurs to ensure that all the compliance requirements and any changes to the wording of specific provisions are updated and reviewed within the compliance matrices and the compliance narrative. Effect Amtrak is not in compliance with the 2 CFR 200.302 (a) and 2 CFR 200.303. This may also put Amtrak at greater risk of non-compliance with specific provisions in accordance with the federal awards. Questioned Costs None. Context We have reviewed the federal awards in scope and the compliance matrices and compliance narrative maintained by the Company as part of the audit procedures in connection with testing of earmarking and special tests and provisions compliance requirements. Identification as a Repeat Finding Not a repeat finding. However, we have noted similar control deficiencies related to completeness of the compliance matrices in prior years. Recommendation We recommend that Amtrak establishes a more defined timeline for the events that would trigger the update and review of the compliance matrices and compliance narrative, which could include execution of any new federal awards or amendments to existing federal awards. Additionally, Amtrak should establish a process where the modifications to the provisions are assessed for materiality/applicability and include documentation of the respective conclusions as part of the review process. Views of Responsible Officials Amtrak acknowledges the need to augment process documentation around the controls over the preparation and updates to the compliance matrices. The company is in the process of updating these controls now and will incorporate the identified findings in developing more robust controls. The company specifically notes the need to add more documentation on considerations for what provisions are updated in the compliance matrices and the evidence of review. The review procedures and controls are being enhanced to include a checklist to improve the review. This checklist will be completed by both the compliance matrix creator (upon creation) and the compliance matrix reviewer/approver (upon review and final approval).
Finding 2024-001: Preparation of Schedule of Expenditures of Federal Awards (SEFA) Program Name: Multiple federal programs Criteria 1. The code of federal regulations – 2 CFR 200.302 Financial management requires that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State’s funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. (b) The recipient’s and subrecipient’s financial management system must provide for the following: (1) Identification of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number, year the Federal award was issued, and name of the Federal agency or pass-through entity. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in § 200.328 and § 200.329. When a Federal agency or pass-through entity requires reporting on an accrual basis from a recipient or subrecipient that maintains its records other than on an accrual basis, the recipient or subrecipient must not be required to establish an accrual accounting system. This recipient or subrecipient may develop accrual data for its reports based on an analysis of the documentation on hand. 2. The code of federal regulations – 2 CFR 200.303 Internal controls requires that recipients and subrecipients must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award. (c) Evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified. Condition The following exceptions to the criteria were observed during the performance of the audit procedures: 1. After the completion of internal review and approval process that Amtrak has established for SEFA preparation and review, we have received multiple updated versions of the schedule with changes to FY24 expenditure amounts for three Assistance Listings included on the SEFA. Total expenditures increased by $80.2 million from version 1 to the final version received. 2. The starting point of the SEFA preparation for the current year was not the audited FY23 SEFA submitted to Federal Audit Clearinghouse, as we have identified that Amtrak subsequently made changes to the FY23 internal SEFA document without reconciling the changes to the audited FY23 SEFA, which resulted in the total cumulative expenditures as of 9/30/2023 to be updated and as such impacting the FY24 expenditures for the respective federal programs. One of the adjustments related to the Hudson Yards Concrete Casing project (HYCC-3) which initially incorrectly recorded $25.0 million of prepaid expenditures. 3. As Assistance Listing #20.314 has been obligated as of 9/27/2024, Amtrak has recorded expenditures related to the HYCC-3 project under this program for the established pre-award period, which dated from January 30, 2023 as part of the FY24 expenditures. Previously, a portion of the total expenditures was included within the FY23 SEFA under Assistance Listing #20.315, for the total amount of $15.6 million. This amount was not adjusted out of the cumulative expenditures for Assistance Listing #20.315 until 2025. Consequently, these expenditures were listed both within the FY23 SEFA under Assistance Listing #20.315 and under the FY24 SEFA as Assistance Listing #20.314 expenditures. 4. As part of SEFA preparation as it relates to allocation of operating expenditures across multiple funding sources, certain projects were incorrectly mapped to annual grants funding source, which resulted in approximately $0.3 million of operating expenses to be included within Assistance Listing #20.315 that were also reported under Assistance Listing #97.075. Cause Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not operating in a manner that would timely identify the conditions noted. Additionally, Amtrak’s controls around allocation of federal funding to project codes were not designed in a manner that would timely identify the conditions noted. In reviewing management’s controls around the SEFA preparation, the design of key controls identified by management does not include an overarching review of the SEFA and reconciliation of what’s been reported on the SEFA from individual projects’ standpoint when such projects have multiple assistance listings as funding sources. We also noted that there was not a specific control that ensures timely updates of Work Breakdown Structure (WBS) funding assignments and allocations when there is a change such as a new grant agreement signed. Effect Amtrak’s control procedures in place as it relates to the preparation of the SEFA were not designed in such a manner that would timely identify the conditions noted, which resulted in several versions of the SEFA that were erroneous and inclusion of expenditures that were double counted within the SEFA. This puts Amtrak at greater risk of non-compliance with its grant agreements with respect to questioned costs and an inaccurate SEFA. Questioned Costs None. Context The SEFA, as originally provided, had exceptions as described in the Condition section above noted for matters 1 and 2 in the Criteria section above, indicating that certain internal controls were not functioning as designed and others were not designed effectively. Identification as a Repeat Finding Not a repeat finding. Recommendation We recommend Amtrak to strengthen the SEFA oversight process to ensure appropriate preparation and review of the SEFA to validate its accuracy, including reconciliation with prior year audited SEFA. This should include having one reviewer take overall responsibility for the completeness and accuracy of the final submitted SEFA. This robust review process should include appropriate procedures to confirm accuracy of the SEFA, which may include a protocol where representatives from various groups (both discretionary and non-discretionary federal programs) work collaboratively to review the SEFA and underlying details of expenditures, to ensure all the adjustments have been properly reflected as well as any projects that might have multiple fund sources are identified timely and reviewed for appropriate inclusion within the SEFA. Additionally, Amtrak should establish a process where any modifications of WBS funding assignments and allocations are updated in a timely manner. Views of Responsible Officials Amtrak recognizes the need to improve the preparation and review of the SEFA. The company has documented the steps for preparing and reviewing the SEFA within its process narrative. The company will update the narrative to address the preparation and review issues that led to the multiple versions of the SEFA being provided during the audit. The company will review and update the Grants Management Compliance Narrative and controls to improve timing of updates for modifications of WBS funding assignments. The company is in the process of updating the SEFA preparation documentation for FY2025, which will be used at the end of the year. The review procedures and controls are being enhanced to include a checklist to improve the review.
FINDING 2024-030 Rehabilitation Services Vocational Rehabilitation Grants to States, ALN 84.126, Reporting - Accuracy of Financial Reports See Schedule of Findings and Questioned Costs for chart/table. Condition LEO did not submit accurate financial reports to the U.S. Department of Education for 2 of 4 sampled Vocational Rehabilitation Financial Reports (RSA-17). In these 2 RSA-17 reports, line items included incorrect expenditure amounts, resulting in overstating or understating the expenditures. Our results are summarized in the following table: See Schedule of Findings and Questioned Costs for chart/table. Criteria Federal regulation 2 CFR 200.302(b)(2) requires states to submit accurate financial data in accordance with a grant program's reporting requirements. The reporting instructions include specific details for reporting information, such as expenditures and indirect costs made in the federal fiscal year for the grant year being reported. Cause LEO's internal control was not sufficient to detect data entry errors included in the submitted reports. Effect LEO may have diminished the federal grantor agency's ability to ensure appropriate oversight and monitoring of Rehabilitation Services Vocational Rehabilitation Grants to States funds. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend LEO improve its internal control and submit accurate financial reports to the U.S. Department of Education. Management Views LEO agrees with the finding.
Finding 2024-001 U.S. Department of the Treasury Community Development Financial Institutions Fund Equitable Recovery Program (CDFI ERP) Assistance Listing No. 21.033 Criteria – 2 CFR 200.510(b) of the Uniform Guidance states that the auditee is responsible for preparing the Schedule of Expenditures of Federal Awards (SEFA). 2 CFR 200.302(b) of the Uniform Guidance states that a nonfederal entity must identify in its accounts all federal awards received and expended, as well as the federal programs under which they were received, and those amounts must be accurately and completely reported on the SEFA. Condition – The Organization consists of Hawaiian Community Assets, Inc. (HCA) and its subsidiary Hawaii Community Lending, Inc. (HCL). The CDFI ERP program is managed by HCL. During the year ended September 30, 2024, HCL used the CDFI ERP grant award amount of $500,000 to fund seven loans. Subsequent to the fiscal year end, but prior to the audit, HCL determined the borrower for five of the seven loans, totaling approximately $299,882, did not meet the geographical eligibility requirements. HCL was able to identify other non-federal funding to fund the five loans deemed ineligible and made the necessary corrections in its grant reporting to the federal agency. However, HCL did not make corrections to its accounting records and SEFA. Cause – HCL did not have a process in place to ensure the accurate reporting of its federal expenditures in its SEFA. Effect or Potential Effect – Federal expenditures are over/under reported or in the wrong fiscal period. A federal program may be misidentified as a major or non-major program and thus, may be improperly included or excluded from required audit procedures. Questioned Costs – None. Context – Total federal expenditures in the SEFA were reduced from $7,459,199 to $7,159,317. CDFI ERP expenditures were reduced from $500,000 to $200,118. The CDFI ERP grant award period does not end until September 30, 2028 and HCL has $299,882 remaining in CDFI ERP funding to fund future loans to borrowers who meet the eligibility requirements. Recommendation – HCL should implement procedures to ensure accurate reporting of its federal expenditures in its SEFA, including having an appropriate member of management review the SEFA. Responsible Official’s Response and Corrective Action Planned – Refer to the Corrective Action Plan.
Capital Fund Program Grants Draws Condition: During our audit procedures over revenue recognition for the Capital Fund Program (CFP), we identified drawdowns of federal funds for which the client was unable to provide adequate supporting documentation. Specifically, the expenditures associated with the draw requests lacked invoices, contracts, or other substantiating records to demonstrate that the costs were allowable, allocable, and incurred in accordance with applicable federal requirements. Criteria: Per 2 CFR §200.403 and §200.302, costs charged to federal awards must be adequately documented and supported by source documentation. Additionally, 2 CFR §200.516(a)(3) requires auditors to report known questioned costs exceeding $25,000 for any federal program, even if not selected as a major program. Cause: The deficiency appears to result from inadequate internal controls over documentation retention and grant compliance monitoring for the CFP. Effect: The lack of documentation impairs the auditor’s ability to verify the allowability of expenditures, resulting in known questioned costs exceeding $25,000. Questioned Cost: $90,149 Recommendations: We recommend that management implement procedures to ensure that all draw requests under the CFP are supported by complete and accurate documentation. This includes maintaining invoices, contracts, and payment records that clearly link expenditures to the approved scope of work under the grant. Management Response: Today’s Marlboro County Housing Authority management acknowledges the auditor’s finding that documentation to support certain CFP drawdowns was incomplete or missing and concurs that this represents a failure to comply with Uniform Guidance documentation requirements under 2 CFR §200.302 and §200.403. The Authority recognizes the importance of maintaining complete and accurate supporting records—such as invoices, contracts, and payment documentation—to substantiate costs charged to federal programs and ensure allowability and allocability under the Capital Fund Program. Effective October 1st, 2024, all draw requests under the Capital Fund Program ARE supported by: Approved contracts or purchase orders Invoices or other source documents Proof of payment (e.g., canceled checks, ACH confirmations) Documentation clearly linking each expense to an approved activity in the CFP Annual Statement
Assistance Listing, Federal Agency, and Program Name 97.039, Hazard Mitigation Grant Program Federal Award Identification Number and Year 4394-31, 2024 Pass through Entity South Carolina Emergency Management Division Finding Type Material weakness and material noncompliance with laws and regulations Repeat Finding No Criteria In accordance with 2 CFR section 200.302(b)(6), all non federal entities must establish written procedures to implement the cash management requirements of 2 CFR section 200.305. Condition The Organization did not have a formal cash management policy in place for the period under audit. Questioned Costs None If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported N/A Identification of How Questioned Costs Were Computed N/A Context After discussion with management, it was identified that the organization does not maintain a formal cash management policy. Cause and Effect There is not an established control to ensure that a written policy is in place. Because there is no written policy, the Organization is not in compliance with 2 CFR 200.302(b)(6). Recommendation We recommend that the Organization implement a formal cash management policy and that controls are implemented to ensure that it is maintained and updated, as necessary. Views of Responsible Officials and Planned Corrective Actions The Organization implemented a Federal Awards Administration Policy which includes a formal cash management policy in February 2025.
Finding Number: 2024-004 Prior Year Finding Number: 2023-011 Compliance Requirement: Reporting Program: U.S. Department of the Treasury COVID-19 – Emergency Rental Assistance (ERA) Program ALN: 21.023 Award #: N/A Award Year: 12/27/2020 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Subrecipient expenditures, totaling approximately $29.8 million, which are required to be presented in the Schedule of Expenditures of Federal Awards (SEFA), were improperly excluded from the initial SEFA prepared by management. Subsequently, the SEFA was adjusted by DHS to reflect the subrecipient expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – DHS did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that DHS adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS Office of the Chief Financial Officer (OCFO) concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.
Finding Number: 2024-007 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of the Treasury COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Year: 10/01/2021 – 09/20/2024 Government Department/Agency: Office of the Deputy Mayor for Planning and Economic Development (DMPED); Office of the State Superintendent of Education (OSSE); Department of Employment Services (DOES); Department of Energy and Environment (DOEE); Department of Behavioral Health (DBH); Office of Neighborhood Safety and Engagement (ONSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – During the audit, of the total amounts passed through to subrecipients of $69.6 million, we noted that certain grant expenditures totaling approximately $14.8 million were erroneously reflected as amounts passed through to subrecipients on the initial Schedule of Expenditures Federal Awards (SEFA) under ALN 21.027, COVID-19 - Coronavirus State and Local Fiscal Recovery Funds. Total amounts passed through to subrecipients should have been $54.8 million. OCFO subsequently adjusted the SEFA to reflect the correct amounts passed through to subrecipients for the major program. Questioned Costs – None. Context – This is a condition identified per review of various agencies’ compliance with specified requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – The District agencies did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that the District agencies adhere to instituted policies and procedures to ensure accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The District agencies agree with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.
Finding Number: 2024-036 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Subrecipient expenditures, totaling approximately $1.1 million, which are required to be presented in the Schedule of Expenditures of Federal Awards (SEFA), were improperly excluded from the initial SEFA prepared by management. Subsequently, the SEFA was adjusted by DBH to reflect the subrecipient expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – DBH did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that DBH adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.
Finding Number: 2024-036 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Subrecipient expenditures, totaling approximately $1.1 million, which are required to be presented in the Schedule of Expenditures of Federal Awards (SEFA), were improperly excluded from the initial SEFA prepared by management. Subsequently, the SEFA was adjusted by DBH to reflect the subrecipient expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – DBH did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that DBH adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.
Unsupported MTW Capital Fund Program (CFP) Drawdowns Funds (ALN 14.881) Condition: During testing of the Moving to Work Demonstration Program - Capital Fund Program, we selected a sample of eight eLOCCS drawdown vouchers for review. Of these, the Authority was unable to provide sufficient supporting documentation to substantiate the eligibility, timing, or purpose of the drawdowns for two vouchers. In addition, for one voucher, the Authority did not provide evidence of immediate obligations or expenditures to support the drawdown, indicating a potential violation of the federal “just-in-time” funding requirement. Criteria: Under 2 CFR §200.302(b)(3) and §200.305(b), non-Federal entities must maintain adequate documentation to support all federal fund drawdowns and ensure that funds are drawn only when needed for immediate disbursement. Additionally, under the Moving to Work Demonstration Program (ALN 14.881), participating agencies must adhere to the terms of their HUD-approved MTW Agreement, which incorporates applicable requirements of the Uniform Guidance, including principles of financial management and internal control. MTW agencies must ensure that drawdowns are supported by actual, timely obligations and expenditures, and must maintain records sufficient to permit the tracing of funds to a level that ensures proper use in accordance with MTW statutory purposes and HUD requirements. Cause: The Authority lacked sufficient internal controls to ensure that drawdowns were properly documented at the time of request and reimbursement requests aligned with immediate, allowable expenditures. Effect: The drawdowns associated with the two unsupported vouchers are considered potentially unallowable, and the improperly timed drawdown may be noncompliant with federal cash management standards, increasing the risk of recapture, repayment, or audit findings. Questioned Costs: $1,501,783 Recommendation: The Authority should establish or strengthen internal procedures to ensure all drawdown requests are tied to documented and eligible obligations and align with HUD’s “just-in-time” funding policy. Additionally, the Authority should train staff on federal documentation and cash management requirements under 2 CFR Part 200 and HUD guidance. Reply and Corrective Action Plan: To address documentation gaps and timing issues in MTW Capital Fund drawdowns, the Authority will implement a process requiring that all drawdown requests be accompanied by complete supporting documentation. Each request will be reviewed for eligibility and compliance with “just-in-time” funding requirements prior to approval by the Executive Director.
Incomplete Support for Capital Fund Program (CFP) Drawdown Sample (ALN 14.872) Condition: As part of the testing of the Capital Fund Program (CFP) major program, a sample of six drawdown vouchers was selected for review. The Public Housing Authority (Authority) was unable to provide adequate supporting documentation for one voucher in the sample. The missing documentation prevented verification of the eligibility, timing, and allowability of the associated expenditures. Criteria: Under 2 CFR §200.302(b)(3) and §200.305(b), recipients of federal awards must maintain financial records that identify the source and application of federal funds and ensure that all drawdowns are based on actual, allowable, and allocable costs. HUD also requires that all drawdown activity be supported by sufficient records to allow for audit and monitoring review. Cause: The Authority did not have sufficient internal controls or procedures in place to ensure complete documentation was retained and made available for all drawdowns under the CFP program. Effect: The unsupported drawdown identified in the sample raises concerns about the reliability of the Authority’s internal controls over the Capital Fund Program (CFP) drawdown process, may indicate a broader risk of noncompliance affecting the allowability of other drawdowns, and increases the risk of repayment, audit findings, and potential program sanctions due to inadequate supporting documentation. Questioned Costs: $299,305 Recommendation: The Authority should strengthen internal control procedures to ensure all Capital Fund Program (CFP) drawdowns are fully supported and audit-ready, and provide staff training on federal documentation and record retention requirements under 2 CFR Part 200 and applicable HUD guidance. Reply and Corrective Action Plan: The Authority will implement a process to ensure that all Capital Fund Program drawdown requests are supported by documentation that verifies eligibility, timing, and allowability. This includes a review step to confirm completeness before submission.
Missing Required Moving to Work (MTW) Demonstration Program Documentation (ALN 14.881) Condition: During our review of the Authority's administration of the MTW Program, the Authority was unable to provide a copy of its Annual Contributions Contract (ACC), which serves as the foundational agreement between the Authority and HUD for the receipt and use of federal funds. Criteria: Under 2 CFR §200.302 and §200.334, non-Federal entities must maintain effective control over and access to records that support compliance with federal program requirements. The MTW Operations Notice (85 FR 10232) and the Authority's MTW ACC Amendment require that the PHA maintain and certify compliance with its MTW Plan and statutory objectives. The ACC establishes the legal basis for receiving and administering MTW-related federal funds. Cause: The Authority did not have adequate internal procedures to ensure that foundational program documents were retained, tracked, and made available for audit and oversight purposes. Effect: The absence of the Annual Contributions Contract (ACC) impairs verification of the Authority's legal authority to receive and administer HUD funds under the MTW program and may result in HUD compliance findings, delayed approvals, or other administrative sanctions. Questioned Costs: None Recommendation: The Authority should obtain and retain a copy of its executed ACC for audit and HUD monitoring purposes and establish or strengthen internal controls to track and retain all required MTW program records and certifications in accordance with HUD guidance and federal record retention requirements. Reply and Corrective Action Plan: The Authority will locate and archive its Annual Contributions Contract (ACC) to ensure compliance with HUD documentation requirements.
nadequate Tenant File Documentation and Inconsistencies in MTW Housing Assistance and Public Housing Records (ALN 14.881) Condition: During tenant file testing for both the Housing Choice Voucher (HCV) and Public Housing (PH) components of the Moving to Work (MTW) Demonstration Program, we identified multiple deficiencies in the Authority's documentation and reporting practices:1. For the MTW HAP (HCV) sample, the Authority did not properly complete the "Summary Decision on the Unit" section of the HUD Form 52580-A, which documents the final pass or fail outcome of the Housing Quality Standards (HQS) inspection. As a result, it could not be confirmed whether the unit met HQS requirements at the time of assistance. 2. In six out of twenty-three HCV tenant files tested, housing assistance payments did not agree with the amounts reported on HUD Form 50058, and no reconciliations or explanations were provided. 3. For one out of twenty-three HCV tenants, the Authority was unable to provide a Form 50058 covering the period for which the HAP payment was selected, leaving the payment unsupported. 4. In the MTW Public Housing sample, five out of seventeen tenant files contained discrepancies between tenant receipts or rent register balances and the amounts reported on HUD Form 50058, without adequate explanation or reconciliation. 5. For one out of seventeen Public Housing tenants, the Authority was unable to provide any support for either the receipt from or payment to the tenant for the period tested.Criteria: Under 2 CFR §200.302 and §200.303, the Authority must maintain financial management systems and internal controls sufficient to ensure that costs are allowable, supported, and in compliance with program requirements. The MTW Operations Notice and HUD program rules require PHAs to complete and retain accurate HUD Forms 50058 and 52580-A to support rent calculations, assistance payments, and unit eligibility. The Summary Decision on the Unit section of Form 52580-A is critical to documenting compliance with HQS requirements before assistance can begin or continue. Cause: The Authority lacked effective internal controls and monitoring procedures over tenant file documentation, rent calculation, inspection recordkeeping, and HUD form completion and retention. Effect: Failure to properly complete HQS documentation may signal noncompliance with unit inspection requirements and tenant safety standards, while inconsistencies and missing Forms 50058 undermine the reliability of rent and assistance calculations. Additionally, the absence of supporting documentation for tenant receipts or HAP payments results in unsupported costs, increasing the risk of overpayments, underpayments, or questioned costs under the MTW program. Questioned Costs: $378,340 Recommendation: The Authority should establish procedures to ensure that all required forms, including HUD 50058 and 52580-A with completed Summary Decision sections, are accurately filled out and retained in tenant files. Regular reconciliations between payment records, rent ledgers, and HUD reporting systems should be performed to maintain data integrity. Additionally, staff should receive training on HQS documentation, rent and assistance calculations, and federal recordkeeping requirements. To reinforce compliance with MTW and HUD program rules, periodic internal reviews of tenant files should also be conducted.Reply and Corrective Action Plan: The Authority will implement procedures to ensure that HUD Form 52580-A is fully completed for all HQS inspections, establish reconciliation processes for HAP and tenant rent payments against HUD Form 50058, and document any discrepancies. These steps aim to improve the accuracy and completeness of tenant records.
Unsupported and Improper Timing of MTW Capital Fund Program (CFP) Drawdowns (ALN 14.881) Condition: During testing of the Moving to Work Demonstration Program - Capital Fund Program, we selected a sample of eight eLOCCS drawdown vouchers for review. Of these, the Authority was unable to provide sufficient supporting documentation to substantiate the eligibility, timing, or purpose of the drawdowns for four vouchers. For another voucher, the Authority could only partially support the amount drawn. These issues reflect a lack of adequate documentation necessary to substantiate the allowability and propriety of the expenditures charged to the CFP grants. Criteria: Under 2 CFR §200.302(b)(3) and §200.305(b), non-Federal entities must maintain adequate documentation to support all federal fund drawdowns and ensure that funds are drawn only when needed for immediate disbursement. Additionally, under the Moving to Work Demonstration Program (ALN 14.881), participating agencies must adhere to the terms of their HUD-approved MTW Agreement, which incorporates applicable requirements of the Uniform Guidance, including principles of financial management and internal control. MTW agencies must ensure that drawdowns are supported by actual, timely obligations and expenditures, and must maintain records sufficient to permit the tracing of funds to a level that ensures proper use in accordance with MTW statutory purposes and HUD requirements. Cause: The Authority lacked sufficient internal controls to ensure that drawdowns were properly documented at the time of request and reimbursement requests aligned with immediate, allowable expenditures. Effect: The lack of supporting documentation for certain voucher draws impairs the audit team's ability to verify the allowability and propriety of the expenditures. This may result in questioned costs, findings of noncompliance with federal requirements, and potential recovery actions by HUD Questioned Costs: $332,356 Recommendation: The Authority should enhance its internal controls to ensure all voucher draws are fully supported by appropriate documentation, reconciled to actual expenditures, retained in compliance with federal recordkeeping requirements, and that unsupported draws are reviewed for potential corrective actions, including reimbursement to HUD if warranted. Reply and Corrective Action Plan: The Authority will implement a process requiring that all MTW Capital Fund drawdown requests be accompanied by complete supporting documentation. Each request will be reviewed for eligibility and compliance with “just-in-time” funding requirements prior to approval by the Executive Director.
Missing Required Moving to Work (MTW) Demonstration Program Documentation (ALN 14.881) Condition: During our review of the Authority's administration of the MTW Program, the Authority was unable to provide a copy of its Annual Contributions Contract (ACC), which serves as the foundational agreement between the Authority and HUD for the receipt and use of federal funds. Criteria: Under 2 CFR §200.302 and §200.334, non-Federal entities must maintain effective control over and access to records that support compliance with federal program requirements. The MTW Operations Notice (85 FR 10232) and the Authority's MTW ACC Amendment require that the PHA maintain and certify compliance with its MTW Plan and statutory objectives. The ACC establishes the legal basis for receiving and administering MTW-related federal funds. Cause: The Authority did not have adequate internal procedures to ensure that foundational program documents were retained, tracked, and made available for audit and oversight purposes. Effect: The absence of the Annual Contributions Contract (ACC) impairs verification of the Authority's legal authority to receive and administer HUD funds under the MTW program and may result in HUD compliance findings, delayed approvals, or other administrative sanctions. Questioned Costs: None Recommendation: The Authority should obtain and retain a copy of its executed ACC for audit and HUD monitoring purposes and establish or strengthen internal controls to track and retain all required MTW program records and certifications in accordance with HUD guidance and federal record retention requirements. Reply and Corrective Action Plan: To address missing foundational documentation, the Authority will locate and archive its Annual Contributions Contract (ACC), the required supplement to the annual MTW Plan, the HUD-issued approval letter for the supplement, and complete the MTW Certification of Compliance for the most recent fiscal year.
Incomplete Tenant File Documentation and Inconsistencies in MTW Housing Assistance and Public Housing Records (ALN 14.881) Condition: During tenant file testing for both the Housing Choice Voucher (HCV) and Public Housing (PH), components of the Moving to Work (MTW) Demonstration Program, we identified multiple deficiencies in the Authority’s documentation and reporting practices:1. For six out of sixteen HCV tenants, the Authority was unable to provide the tenant file for review. 2. Among the files that were available, several lacked required documentation for the required period to support continued occupancy, rent adjustments, reexaminations, income verification, and inspections. 3. Additionally, variances were noted between the amounts reported on HUD Form 50058 and the actual HAP/UAP disbursements made.Criteria: Under the MTW Operations Notice (85 FR 10232), 2 CFR §200.302, and HUD regulations at 24 CFR §982, public housing authorities must maintain complete and accurate tenant files and ensure that all disbursements are supported by appropriate documentation. HUD Form 50058 must accurately reflect the tenant’s eligibility and payment information, and all payments must be consistent with the amounts authorized and documented in the tenant file. Cause: The Authority lacked effective internal controls and monitoring procedures over tenant file documentation, rent calculation, inspection recordkeeping, and HUD form completion and retention. Effect: Incomplete tenant files and discrepancies between reported and actual disbursements impair the Authority’s ability to demonstrate compliance with HUD requirements. These issues increase the risk of improper payments, audit findings, and potential administrative sanctions. Questioned Costs: $462,754 Recommendation: The Authority should strengthen its internal controls over tenant file maintenance and disbursement reconciliation. All tenant files should be reviewed for completeness, and missing documentation should be obtained. Disbursements should be reconciled to HUD Form 50058 and verified against supporting documentation. Staff should receive training on documentation and compliance requirements under the MTW HAP program, and periodic quality control reviews should be implemented to ensure ongoing compliance. Reply and Corrective Action Plan: The Authority will implement a process to improve tenant file management, ensure complete documentation for occupancy and eligibility, and reconcile disbursement variances with HUD Form 50058 to strengthen compliance with MTW Housing Assistance Payment requirements.
Missing Receipt Support for MTW Public Housing Tenant Transactions (ALN 14.881) Condition: A review of tenant files under the Moving to Work (MTW) Public Housing program found that while the tenant files themselves were complete, the Authority did not provide supporting documentation for certain rent receipts. In several instances, the rent amounts recorded in the receipt or rent register did not agree with the amounts reported on HUD Form 50058, and no receipt documentation was available to reconcile the difference. Criteria: Under the MTW Operations Notice (85 FR 10232), 2 CFR §200.302, and HUD regulations at 24 CFR §960, public housing authorities must maintain complete and accurate records that support rent calculations, payments, and tenant eligibility. HUD Form 50058 must accurately reflect tenant rent obligations, and all payments must be properly documented and reconciled. Cause: The Authority did not maintain adequate documentation to support rent receipts and reconcile them with HUD Form 50058 data. Effect: The absence of receipt documentation impairs the Authority’s ability to demonstrate compliance with HUD requirements and increases the risk of rent misstatements, audit findings, and potential administrative sanctions. Questioned Costs: $125,170 Recommendation: The Authority should implement procedures to ensure all rent receipts are supported by appropriate documentation and reconciled to HUD Form 50058, provide staff training on documentation and recordkeeping requirements, and conduct periodic internal reviews of tenant files to verify that all payment records are complete and accurate. Reply and Corrective Action Plan: To address missing rent receipt documentation and inconsistencies with HUD Form 50058, the Authority will implement procedures to improve tenant file management, ensure all receipts are properly documented, and reconcile rent records to support accurate reporting and compliance.
Condition: Out of the 72 grant drawdowns during the year, 24 drawdowns were tested and it was noted that 1 of the drawdowns was made in advance of the supporting invoices being paid to the vendors and subsequently the invoices were not paid within the 72-hours, as required. Context: The auditor haphazardly selected 24 grant drawdowns from the population, which we consider to be a statistically valid sample size. The auditor reviewed the drawdowns and supporting documentation to ensure proper procedures are being followed and that the Agency is in compliance with HUD requirements. Criteria: The U.S. Treasury per 2 CFR section 200.305 (2 CFR section 200.302(b)(6)) requires grant funds received by the Authority to be properly spent within 72 hours of receipt. HUD regulations require that proper documentation be maintained for all Capital Fund Program per 24 CFR 905.326. Cause: The Agency experienced staff turnover in the finance department as well as difficulty replacing personnel knowledgeable with HUD and grant reporting requirements. Effect: The Agency did not disburse the capital funds in a timely manner for one of the draws made during the year. Questioned Costs: $40,500 Auditor’s Recommendations: The Agency should continue to develop and implement internal controls over grant management to coordinate capital fund draws with the timing of invoice payments. View of Responsible Officials: See Corrective Action Plan
2024-004 Type of Finding: Material Weakness in Internal Control over Compliance Federal Agency: Department of Housing and Urban Development Federal Program Name: Moving to Work Demonstration Program Assistance Listing Number: 14.881 Federal Award Identification Number and Year: WA005VOW089-WA005VOW094 – 2024 Pass-Through Agency: Pierce County Pass-Through Number: SC-110242 & SC-111165 Award Period: July 1, 2023 – June 30, 2024; July 1, 2024 – June 30, 2025 Criteria or Specific Requirement: 2 CFR 200.302(a) on Financial management states that “All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award". Condition: During Activities Allowed or Unallowed; Allowable Costs / Cost Principles testing, 3 of the 40 samples selected did not include sufficient documentation to support the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 3 samples. During Eligibility testing, 2 of the 8 samples selected did not include sufficient documentation to support the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. During Special Tests and Provisions testing, 2 of the 16 samples selected did not retain documentary evidence of compliance with the Rent Reasonableness and Housing Quality Standards requirements. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Questioned Costs: None Context: Activities Allowed or Unallowed; Allowable Costs / Cost Principles: A sample of 40 disbursements were taken from a population of over 250 individual charges to the major program. Of the 40 sampled, 3 were insufficiently supported to agree to the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 3 samples. Eligibility: A sample of 8 was made from a population of 63 major program participants. Of the 8 sampled, 2 had benefit costs that were insufficiently supported to agree to the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Special Tests and Provisions: A sample of 8 was made from a population of 63 major program participants, each with two Special Tests and Provisions requirements (Rent Reasonableness and Housing Quality Standards) for a total of 16 samples. Of the 8 participants sampled, 1 file did not include a Rent Reasonableness Checklist and Certification form nor a Housing Quality Standards Inspection form. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Cause: Support was not found during fieldwork, as source documentation related to payments made for program participants are inconsistently retained in the participant's files. Documentation should be ready for audit at the time of fieldwork. Effect: Without adequate documentation in place to ensure costs are evidenced and reconcile to the expenditures documented in the underlying accounting information that is used to prepare the SEFA, Associated Ministries of Tacoma - Pierce County could incorrectly charge expenditures to the federal program, or not request appropriate reimbursement that Associated Ministries of Tacoma - Pierce County is entitled to under the terms of the grant. Repeat Finding: No. Recommendation: CLA recommends that Associated Ministries of Tacoma - Pierce County implement a policy to retain all invoices, receipts, bills, and other similar source documents within each client file behind each Check Request form. In addition, program staff should retain a clear paper trail that documents the difference between monthly rent as specified on the lease agreements to the amount disbursed on behalf of the participant. This will enhance clarity of costs attributable to the major program. View of Responsible Officials: There is no disagreement with the audit finding.
2024-004 Type of Finding: Material Weakness in Internal Control over Compliance Federal Agency: Department of Housing and Urban Development Federal Program Name: Moving to Work Demonstration Program Assistance Listing Number: 14.881 Federal Award Identification Number and Year: WA005VOW089-WA005VOW094 – 2024 Pass-Through Agency: Pierce County Pass-Through Number: SC-110242 & SC-111165 Award Period: July 1, 2023 – June 30, 2024; July 1, 2024 – June 30, 2025 Criteria or Specific Requirement: 2 CFR 200.302(a) on Financial management states that “All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award". Condition: During Activities Allowed or Unallowed; Allowable Costs / Cost Principles testing, 3 of the 40 samples selected did not include sufficient documentation to support the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 3 samples. During Eligibility testing, 2 of the 8 samples selected did not include sufficient documentation to support the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. During Special Tests and Provisions testing, 2 of the 16 samples selected did not retain documentary evidence of compliance with the Rent Reasonableness and Housing Quality Standards requirements. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Questioned Costs: None Context: Activities Allowed or Unallowed; Allowable Costs / Cost Principles: A sample of 40 disbursements were taken from a population of over 250 individual charges to the major program. Of the 40 sampled, 3 were insufficiently supported to agree to the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 3 samples. Eligibility: A sample of 8 was made from a population of 63 major program participants. Of the 8 sampled, 2 had benefit costs that were insufficiently supported to agree to the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Special Tests and Provisions: A sample of 8 was made from a population of 63 major program participants, each with two Special Tests and Provisions requirements (Rent Reasonableness and Housing Quality Standards) for a total of 16 samples. Of the 8 participants sampled, 1 file did not include a Rent Reasonableness Checklist and Certification form nor a Housing Quality Standards Inspection form. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Cause: Support was not found during fieldwork, as source documentation related to payments made for program participants are inconsistently retained in the participant's files. Documentation should be ready for audit at the time of fieldwork. Effect: Without adequate documentation in place to ensure costs are evidenced and reconcile to the expenditures documented in the underlying accounting information that is used to prepare the SEFA, Associated Ministries of Tacoma - Pierce County could incorrectly charge expenditures to the federal program, or not request appropriate reimbursement that Associated Ministries of Tacoma - Pierce County is entitled to under the terms of the grant. Repeat Finding: No. Recommendation: CLA recommends that Associated Ministries of Tacoma - Pierce County implement a policy to retain all invoices, receipts, bills, and other similar source documents within each client file behind each Check Request form. In addition, program staff should retain a clear paper trail that documents the difference between monthly rent as specified on the lease agreements to the amount disbursed on behalf of the participant. This will enhance clarity of costs attributable to the major program. View of Responsible Officials: There is no disagreement with the audit finding.
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan