Finding 2024-003: 93.591 - U.S. Department of Health and Human Services - Family Violence Prevention and Services/State Domestic Violence Coalitions Allowable Costs/Cost Principles, Significant Deficiency in Internal Control and Noncompliance Criteria: According to 2 CFR § 200.302(b)(5), non-federal entities must have written procedures to ensure that expenditures are in accordance with the terms and conditions of the federal award. Furthermore, entities are expected to compare actual expenditures with budgeted amounts for each federal award. Condition: During our audit, we noted that the Organization does not maintain or regularly review a budget-to-actual comparison for expenditures charged to the federal grant. As a result, management is unable to assess whether spending is aligned with the approved grant budget. Effect: Failure to monitor expenditures against the approved grant budget increases the risk of unallowable costs, budget overruns, and noncompliance with grant terms, which may result in questioned costs or potential repayment of funds. Questioned Costs: None. Cause: The Organization has not established internal procedures or systems to monitor grant expenditures against the approved budget. _x000C_Recommendation: We recommend that the Organization implement a process to compare actual expenditures to the approved grant budget on a regular basis. This may include monthly or quarterly reviews by program and finance staff to ensure expenditures remain within approved categories and thresholds. Documentation of such reviews should be maintained to demonstrate compliance.
Finding 2024-004: 93.591 - U.S. Department of Health and Human Services - Family Violence Prevention and Services/State Domestic Violence Coalitions Allowable Costs/Cost Principles, Material Weakness in Internal Control and Noncompliance Criteria: In accordance with 2 CFR §200.403(g), costs must be adequately documented in order to be allowable under a federal award. Additionally, per 2 CFR §200.302(b)(3), recipients must maintain records that identify the source and application of funds for federally funded activities. Furthermore, effective internal controls per 2 CFR §200.303 require that transactions be properly authorized and reviewed to ensure compliance with applicable requirements. Condition: During our testing of expenses charged to the federal award, we reviewed a sample of 10 transactions totaling $9,284. Of those, 7 transactions (representing $8,980) were found to be noncompliant due to one or both of the following: • Missing supporting documentation, such as receipts or invoices • Missing approval documentation, such as required supervisor sign-offs These issues impaired our ability to determine whether the expenses were allowed, reasonable, and allocable under the terms of the award. Due to the high rate of errors, we performed extrapolation procedures over the population of similar expenses totaling $107,782. Based on the sample error rate and our extrapolation methodology, we estimate that $36,846 of the total expenses charged to the federal award may be unallowable and are thus considered extrapolated questioned costs. Effect: As a result of insufficient supporting and approval documentation, the allowability of a significant portion of expenses charged to the federal award could not be determined. This has led to an extrapolated questioned cost of $36,846. Questioned Costs: $36,846 (extrapolated) Cause: The deficiencies noted appear to be the result of weak internal controls related to documentation and approval workflows for federal expenditures. Specifically, the Organization does not appear to have a consistent process to: • Ensure documentation is retained for all expenses • Verify and record supervisory or grant-related approvals Recommendation: We recommend the Organization take immediate steps to improve internal controls related to documentation and record retention for federal program expenditures. The Organization should ensure that all expenses charged to the federal award are supported with adequate documentation. Additionally, the Organization should also ensure approvals are properly documented regardless if the expense is paid by check or electronic payment.
2024-005 – Insufficient Financial Management Condition: The Organization drew down more revenues than expenditures incurred. Criteria: The VA Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program regulations (38 CFR Part 78) and the Uniform Guidance (2 CFR 200.302) require grantees to maintain a financial management system that provides accurate, current, and complete financial information, effective control over federal funds, and adequate documentation supporting all costs charged to the program. Financial management is considered insufficient when accounting practices do not ensure timely, accurate, and supported reporting of expenditures and drawdowns. Effect: Failure to maintain accurate financial data will result in discrepancies between expenditures and draw-downs. It also increases the risk of inaccurate financial results provided at closeout or unauthorized or ineligible expenses charged to the award, which may result in funding shortages for other qualified expenses. Cause: Homeward Bound Adirondack, Inc. failed to provide adequate oversight and internal controls to ensure the maintenance of accurate financial records. Specifically, credit card charges were recorded in the general ledger based on the day the charges cleared rather than the date the costs were incurred. This practice resulted in delays in recording expenditures, causing them to be recorded in the incorrect period. Recommendation: We recommend that Homeward Bound Adirondack, Inc. establish oversight practices to ensure that all revenues and expenses are recorded appropriately and reconciled to the proper drawdown requests. Response: Homeward Bound Adirondack, Inc. agrees with the finding and will implement procedures to address the recommendation in 2025.
Finding 2024-005 – Period of Performance Federal Agency: U.S. Department of Treasury Federal Program: Coronavirus State and Local Fiscal Recovery Funds AL Number: 21.027 Pass-through: Community Shelter Board Award Number: YMCA-24-CSB and YMCA-25-CSB Award Year: 7/1/2023 – 6/30/2024 and 7/1/2024 – 6/30/2025 Type of Finding: Material Weakness and Noncompliance Criteria: 2 CFR 200.403(h): Administrative closeout costs may be incurred until the due date of the final report(s). If incurred, these costs must be liquidated prior to the due date of the final report(s) and charged to the final budget period of the award unless otherwise specified by the Federal agency. All other costs must be incurred during the approved budget period. 2 CFR 200.302: The recipient's and subrecipient's financial management system must provide for the following: Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: The Association was unable to verify whether costs recorded in the financial accounting system were included in invoices submitted for cost reimbursement. As such, auditors could not verify whether these costs were included in the appropriate period of performance. Context: Out of a sample of 40 transactions tested for compliance with period of performance requirements, 27 of them could not be traced to a reimbursement invoice. Most of these transactions were transfers of payroll costs from one program to another. Cause: The Association did not have a strong process to track program expenses with the financial accounting system and did not effectively reconcile expenditures between the general ledger and the Schedule of Expenditures of Federal Awards. In addition, the Association did not maintain support for expenditures charged to federal grants to be able to support whether they were within the allowable period of performance. Effect: The Association could not provide evidence of whether the transactions tested were within the period of performance. Questioned costs: $602,142 Identification of how questioned costs were computed: Known questioned costs were computed by summing the dollar amount of selections that were identified as errors which totaled $6,829. An error rate was calculated by taking the number of errors divided by the total sample size as described in the Context section. This error rate was then applied to the untested population to calculate projected questioned costs of $595,313. Repeat finding: Not applicable. Recommendation: The Association should review its policies and procedures to ensure costs recorded in the financial accounting system are able to be reconciled to invoices submitted for cost reimbursement as well as the Schedule of Expenditures of Federal Awards. Views of responsible officials: See Corrective Action Plan.
2 CFR § 300 codified in 45 CFR part 75 gives regulatory effect to the Department of Health and Human Services. 2 CFR § 200.302(b)(6) states the financial management system of each non-Federal entity must provide for written procedures to implement the requirements of 2 CFR § 200.305 Payment. Additionally, for Federal awards, the Uniform Guidance requires a written policy for the procurement requirements outlined in 2 CFR § 200.318(c)(1), 2 CFR § 200.318(c)(2), and 2 CFR § 200.320(B) 2 CFR 200.302(b)(7) requires written procedures for determining the allowability of costs in accordance with Subpart E-Cost Principles of this part and the terms and conditions of the Federal award. 2 CFR 200.430 states that costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. 2 CFR 200.431 requires established written leave policies if the entity intends to pay fringe benefits. 2 CFR 200.464(a)(2) requires reimbursement of relocation costs to employees be in accordance with an established written policy must be consistently followed by the employer. 2 CFR 200.475 requires reimbursement and/or charges to be consistent with those normally allowed in like circumstances in the non-Federal entity's non-federally-funded activities and in accordance with non-Federal entity's written travel reimbursement policies. The General Health District did not have written policies as required by Uniform Guidance. The failure to implement written policies as required by Uniform Guidance could result in noncompliance with the District’s federal programs. The General Health District should adopt written policies in accordance with the Uniform Guidance.
Internal Control over Compliance and Compliance with Reporting (Preparation of the Schedule of Expenditures of Federal Awards (SEFA)) ALN: 10.904, Milk River Project ALN: 10.923, Stream Restoration and Bridge Replacement for St. Mary Siphon Failure ALN: 15.U01, Replacement of St. Mary and Hallls Coulee Siphons on St. Mary Canal CRITERIA: The Code of Federal Regulations (CFR) Section §200.510(b) states in part: "The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with CFR Section §200.502 Basis for determining Federal awards expended." The schedule must provide total Federal awards expended for each individual Federal program. CFR 200.302(b)(1) requires that the nonfederal entity must identify in its accounts and on the schedule of expenditures of federal awards all federal awards received and expended, as well as the federal programs under which they were received. Federal program and award identification must include, as applicable, the Assistance Listing program title and number, the federal award identification number and year, the name of the federal agency, and the name of the pass-through entity, if any. CONDITION: The ALN 10.923, Stream Restoration and Bridge Replacement for St. Mary Siphon Failure, was left off the prepared SEFA. Amounts reported for ALN 10.904 and ALN 15.U01 did not agree to the accounting records. CONTEXT: The SEFA was misstated as follows: • Understated for ALN 10.904 by $196,980; • Understated for ALN 10.923 by $105,977; and • Overstated for ALN 15.U01 by $1,978,224. The net effect was an overstatement of $1,675,267 for total federal expenditures. EFFECT: The SEFA provided was not complete and accurate. QUESTIONED COSTS: None CAUSE: The internal controls for the preparation of the SEFA and review of the SEFA were not present to ensure the SEFA was complete and accurate. RECOMMENDATION: We recommend the MRJBOC prepare written procedures on how to put together the SEFA and strengthen internal controls to ensure all federal awards are included on the SEFA. We also recommend that the SEFA be reviewed by someone other than the preparer for completeness and accuracy prior to providing to the auditor. MRJBOC RESPONSE: MRJBOC acknowledges the deficiencies identified in the preparation and review of the Schedule of Expenditures of Federal Awards (SEFA). During 2024, the organization experienced a significant increase in federal funding activity related to emergency response and infrastructure replacement projects. The rapid expansion of federal programs, addition of funds and reporting requirements exceeded existing internal documentation and review processes. To strengthen compliance controls and ensure SEFA accuracy in future reporting periods, MRJBOC will implement the following corrective actions: • Develop and formalize written SEFA preparation procedures, including grant identification, ALN verification, and reconciliation to general ledger balances. • Establish a dual-review process in which the SEFA is reviewed and approved by a party independent from the preparer prior to submission to auditors. • Maintain a centralized federal grant tracking log that includes award numbers, funding sources, drawdowns, and cumulative expenditures. These measures will improve internal control over federal reporting, enhance accuracy, and ensure compliance with federal audit requirements.
Criteria: 2 CFR Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D – Post Federal Awards Requirements, Standards for Financial and Program Management, and §200.302 (b), Financial Management. The recipients financial management system must provide for identification, in its accounts, of all federal awards received and expended and the federal program under which they were received. Federal program and federal award identification must include, as applicable, the federal assistance listing title and number, federal award identification number, name of the federal agency, and name of the pass-through entity, if any. Additional Criteria: 2 CFR Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart F – Audit Requirements, §200.510, Financial Statements. Schedule of Expenditures of Federal Awards – The auditee also must prepare a schedule of expenditures of federal awards for the period covered by the auditee’s financial statements, which must include the total federal awards expended, as determined in accordance with §200.502, Basis for Determining Federal Awards Expended. At a minimum, the schedule must provide total federal awards expended for each individual federal program and the federal assistance listing number or other identifying number when the federal assistance listing information is not available. For a cluster of programs, also provide the total for the cluster. Condition: PCRI did not maintain a complete schedule of expenditures of federal awards. Cause: PCRI did not adequately track which government grants were federally-funded, resulting in an incomplete schedule of expenditures of federal awards. Effect: Failure to prepare an accurate and complete schedule of expenditures of federal awards results in noncompliance with 2 CFR Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D – Post Federal Awards Requirements, Standards for Financial and Program Management, §200.302, Financial Management, and Subpart F – Audit Requirements, §200.510, Financial Statements. Recommendation: We recommend that PCRI document and implement policies and procedures to ensure the schedule of expenditures of federal awards is accurate and complete in accordance with 2 CFR Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D – Post Federal Awards Requirements, Standards for Financial and Program Management, §200.302, Financial Management, and Subpart F – Audit Requirements, §200.510, Financial Statements, in order to obtain accurate calculations of major federal programs for the Single Audit and to ensure that PCRI is in compliance with all of the reporting requirements as to identify the source and application of funds for federally-funded activities.
Lack of Written Procedures for Determining Allowability of Costs Condition: The Agency did not maintain written procedures for determining the allowability of costs charged to federal awards. Although management performs reviews of expenses to ensure reasonableness, these reviews are not guided by documented policies or standardized criteria. Criteria: In accordance with 2 CFR 200.302(b)(7), non-federal entities must maintain written procedures for determining allowability of costs in accordance with Subpart E - Cost Principles of the Uniform Administrative Requirements, Costs Principles, and Audit Requirements for Federal Awards ("Uniform Guidance"). Cause: Management was unaware that Uniform Guidance requires written procedures specifically addressing cost allowability, separate from general internal control or purchasing policies. Effect: Without documented procedures, there is an increased risk that unallowable or unsupported costs may be charged to federal programs, potentially resulting in noncompliance with federal cost principles and repayment obligations. Questioned Cost: None noted as a result of audit procedures performed. Recommendation: Management should develop and implement written procedures for determining allowability of costs consistent with the requirements of 2 CFR 200.302(b)(7). Procedures should clearly define responsibilities, documentation requirements, and approval processes to ensure all cost charged to federal programs are allowable, allocable, and reasonable. Management Response: We agree with the findings in the audit report and have developed a Corrective Action Plan to address each item promptly. This has been a challenging year for the organization, including turnover in the Chief Financial Officer ("CFO") position and the fact that this was our first Single Audit due to increased federal funding related to COVID-19 programs. These factors contributed to delays in audit readiness, gaps in technical accounting for grants, and weaknesses in internal controls over financial reporting and federal award reporting. We have implemented a comprehensive plan to address these challenges and will be hiring a new CFO in the first quarter of 2026.
Finding Reference Number: 2024-002 Reportable finding considered a significant deficiency - Inadequate support for distribution of donated food Title and CFDA Number of Federal Program: Emergency Food Assistance Program: 10.568 & 10.569 Federal award numbers & periods: 22-MOU-00108 23/24. 10/1/2023 - 9/30/2024 22-MOU-00108 24/25. 10/1/2024 - 9/30/2025 Type of Finding: Financial Statement and Federal Award Finding Finding Resolution Status: In Process Identification of Repeat Finding and Finding Reference Number: This is not a repeat finding Criteria: Organizations are required to maintain adequate documentation and an audit trail for all food distributions, including goods sent to distribution sites and goods used for on-site meal preparation, in accordance with sound internal control practices and applicable grant requirements (e.g., Uniform Guidance 2 CFR §200.302 – Financial Management and §200.303 – Internal Controls). Statement of Condition: During the audit, Food Bank Distribution Reports were provided showing goods sent to three locations, including recipient sign-offs, stating they received the food. Each location tracks food received and distributed to individuals. Leftover food is sent to various nonprofits to assist with distribution, if any. However, documentation for goods that were received and not distributed, at these three locations, could not be produced for review as an audit trail for who received and distributed leftover food. Additionally, Congregate Aggregate Feeding Reports, which track goods used for on-site meal preparation, and subsequent distribution, were also not available for review as they were not kept on file. The Organization lacked distribution documentation to support their monthly Distribution Report for goods distributed resulting in an incomplete audit trail. Cause: The Organization did not have formalized procedures or controls to ensure that all food distributions and on-site meal preparation activities were consistently documented and retained. Tracking was handled internally without standardized reporting requirements, resulting in incomplete records. Effect or Potential Effect: The absence of complete supporting documentation limits the Organization’s ability to demonstrate compliance with internal policies and donor requirements. It increases the risk of misstatement, misappropriation of goods, and potential noncompliance with grant or regulatory requirements. Questioned Costs: There are no questioned costs associated with this finding. Context: During our testing of food distribution documentation, we selected Food Bank Distribution Reports from three distribution locations for the audit period. For each location, we reviewed documentation supporting goods received, goods distributed, and any goods remaining at the end of the distribution cycle. While signed recipient logs were available to support goods initially received at the locations, supporting documentation for goods that were received but not distributed—including records identifying where leftover food was subsequently sent—was not available for any of the three locations reviewed. Additionally, for onsite meal preparation activities, we requested Congregate Aggregate Feeding Reports used to track the quantities of goods prepared and served; however, the Organization did not retain these reports for the period under audit. As a result, none of the sampled items related to meal preparation activities had supporting documentation available for review. Recommendation: We recommend that management implement and enforce policies to ensure that all food distributions, including on-site meal preparation and any goods not distributed separately, are properly tracked and supported by documentation. This should include maintaining Congregate Aggregate Feeding Reports, retaining all distribution records and reconciling them to the Monthly Distribution Report, establishing procedures to ensure discarded goods are documented appropriately. These steps will strengthen internal controls and provide a clear audit trail for all commodities. Auditors’ Summary of the Auditee’s Comments on the Findings and Recommendations: See Corrective Action Plan
2 CFR 1000.10 provides that, except for the deviations set forth elsewhere in this Part, the Department of Treasury adopts the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards set forth at 2 CFR Part 200. 2 CFR 200.302 states, in part, the financial management system of each non-Federal entity must provide for accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. 2 CFR 200.329(c)(1) states that non-Federal entities must submit performance reports at the interval required by the Federal awarding agency or pass-through entity to best inform improvements in program outcomes and productivity. Reports submitted quarterly must be due no later than 30 calendar days after the reporting period. 31 CFR 35.4(c) requires recipients, in part, during the period of performance, to provide the Secretary of the U.S. Department of Treasury periodic reports providing detailed accounting of the uses of funds, modifications to a State or Territory's tax revenue sources, and such other information as the Secretary may require for the administration of this section. The U.S. Department of Treasury provided supplementary information in its 2021 interim final rule on reporting requirements for State and Local Fiscal Recovery Funds for 31 CFR Part 35 and provided further guidance in its Project and Expenditure Report User Guide for State and Local Fiscal Recovery Funds. The 2021 interim rule supplementary information, part VIII states that counties will be required to submit quarterly Project and Expenditure reports through the end of the award period on December 31, 2026. The Department of Treasury’s Project and Expenditure Report User Guide provides, in part, that counties with a population that exceeds 250,000 residents must submit a Project and Expenditure Report by January 31, 2022 and then the last day of the month after the end of each quarter thereafter. The County did not have proper internal controls in place to ensure the timely and accurate submission of the Project and Expenditure Reports. During testing of Project and Expenditure Reports for the COVID-19 Coronavirus State and Local Fiscal Recovery Funds (AL #21.027), we noted that: • The County did not submit the Project and Expenditure Reports for the second and fourth quarters by the required deadlines of July 31, 2024 and January 31, 2025, respectively. • On the first quarter Project and Expenditure Report, the County understated current period expenditures by $1,041,688, understated cumulative expenditures by $11,564,350, and understated cumulative obligations by $1,407,879. Similarly, on the third quarter Project and Expenditure Report, the County understated current period expenditures by $385.732, understated the cumulative expenditures by $13,169,950, and understated cumulative obligations by $1,407,879. Failure to have the proper controls in place to ensure the timely and accurate submission of the Project and Expenditure Reports could result in Treasury taking action against the County for failure to comply with programmatic requirements. The County should implement and have controls in place to ensure the quarterly Project and Expenditure Reports are accurate and filed by the required due dates.
ALN 14.251 and ALN 21.027 Finding #2024‐004 Incorrect Recording of Expenditures that were Notes Receivable Draws Repeat Finding: No Condition: The Organization recorded $2,425,133 of federal program expenditures as expenses in the year ended December 31, 2024. These amounts represented disbursements made to a subrecipient under terms that required repayment, and therefore should have been recorded as a note receivable. The Organization did not recognize the note receivable nor properly classify the related transactions, resulting in a misstatement of expenditures and assets. Criteria: In accordance with 2 CFR 200.302 and generally accepted accounting principles (GAAP), the Organization is required to maintain accurate, current, and complete disclosure of financial results of each federal award. Accounting records must adequately identify the source and application of federal funds and properly classify transactions, assets, liabilities, and equity in accordance with GAAP. Cause: The misclassification occurred because the Organization did not have sufficient internal controls to ensure that disbursements under this program were evaluated for the proper accounting treatment (i.e., expense versus note receivable/loan). Effect: Federal program expenditures were overstated by $2,245,133 and assets were understated by the same amount. The lack of proper classification may affect stakeholders’ understanding of the Organization’s financial position and federal compliance. Questioned Costs: None noted, as the expenditures were incurred under the program; however, the classification error represents a material reporting misstatement. Perspective Information: The condition noted represents $2,425,133 of expenditures, which were inaccurately reported. Recommendation: We recommend that the Organization strengthen its review process over accounting for federal program disbursements. Policies and procedures should require evaluation of whether disbursements meet the definition of an expense or a loan/note receivable in accordance with GAAP and federal reporting requirements. Reporting Views of Responsible Officials: The Organization agrees with the finding. The Organization’s accountant was unaware that the federal grant payments to the subrecipient were considered draws on a note receivable. Corrections have been made to improve communication with the accountant to ensure the accountant is aware of key grant provisions and to ensure note receivable draws are being properly accounted for in the general ledger.
ALN 21.027 Finding #2024‐005 Insufficient Accounting to Track Federal Grant Expenditures Repeat Finding: No Condition: The Organization did not maintain accounting records that sufficiently tracked expenditures relating to the federal program. Instead, federal program expenditures were co‐mingled with all other organizational expenditures. As a result, the Organization was unable to readily identify the federal share of costs or demonstrate that the costs charged were allowable under the terms of the award. Criteria: Per 2 CFR 200.302, non‐federal entities must maintain financial management systems that provide for: · Accurate, current, and complete disclosure of financial results of each federal award; · Records that identify adequately the source and application of federal funds; and · Effective control and accountability for all funds, property, and other assets. These requirements include maintaining accounting records that segregate federal program expenditures from non‐federal activity to ensure compliance with applicable statutes, regulations, and terms of the award. Cause: The Organization did not implement accounting controls and procedures to establish separate accounts or cost centers for federal program expenditures. Effect: Because federal program expenditures were not separately tracked, there is an increased risk of: · Unallowable or unsupported costs being charged to the program, · Inaccurate reporting on the Schedule of Expenditures of Federal Awards (SEFA), and · Noncompliance with Uniform Guidance financial management standards. Questioned Costs: None noted. Perspective Information: The condition affected one of the Coronavirus State and Fiscal Recovery – ARPA grants, ALN 21.027, which accounted for $153,653 of federal expenditures for 2024. Recommendation: We recommend that the Organization implement an accounting system that separately tracks federal program expenditures, either through distinct general ledger accounts, cost centers, or project codes. The system should allow management to readily identify federal expenditures, prepare accurate SEFA reporting, and demonstrate compliance with federal requirements. Reporting Views of Responsible Officials: The Organization agrees with the finding. The Organization is in process of implementing a project‐based ledger and procedures to ensure federal expenditures are properly coded so they are readily identifiable.
ALN 14.251 and ALN 21.027 Finding #2024‐006 Financial Policies and Procedures Repeat Finding: No Condition: The Organization did not have formalized, written financial policies and procedures that address key Uniform Guidance requirements. Criteria: Under 2 CFR 200.302(b), non‐federal entities must establish and maintain effective financial management systems that provide accurate, current, and complete disclosure of the financial results of each federal award. Uniform Guidance further requires that entities implement written policies and procedures governing: · Allowable costs (2 CFR 200.302(b)(7) and 200.403–200.405), · Procurement (2 CFR 200.317–200.327), · Cash management (2 CFR 200.305), · Travel costs (2 CFR 200.475), and · Conflict of interest (2 CFR 200.318(c)(1)). Written policies serve as the framework for consistent compliance with federal requirements. Cause: The Organization had not developed or adopted written financial policies, relying instead on informal practices and staff knowledge to manage federal awards. Effect: The absence of formalized financial policies increases the risk of noncompliance with Uniform Guidance, inconsistent application of requirements, and potential misuse of federal funds. The lack of a documented framework also limits accountability and makes it difficult to train new staff or demonstrate compliance to oversight agencies. Questioned Costs: None noted. Perspective Information: This condition applied to the Organization’s overall financial management system and impacted all federal programs administered during the year ended December 31, 2024. As such, the lack of formalized financial policies represents a systemic issue and a material weakness in internal control over compliance. Recommendation: We recommend that the Organization adopt formal, written financial policies and procedures that address all Uniform Guidance requirements applicable to federal awards. These policies should be approved by management and the governing body, disseminated to staff, and reviewed periodically to ensure continued compliance. Reporting Views of Responsible Officials: The Organization agrees with the finding. The Organization will establish formalized accounting policies and procedures that adhere to the requirements of the Uniform Guidance.
Finding 2024-005 - Reporting Federal Award Information: Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: Texas Department of Housing and Community Affairs Assistance Listing Number (ALN): 93.568 Federal Program Name: Low-Income Home Energy Assistance Type of Finding: Material Weakness in Internal Control Over Compliance Reporting Compliance Requirement No Questioned Costs Criteria: Under 2 CFR 200.303, the Organization is required to establish and maintain effective internal control over Federal awards that provides reasonable assurance of compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, 2 CFR 200.302(a) requires that the financial management system provide accurate, current, and complete disclosure of the financial results of each Federal award. Further, 2 CFR 200.334 requires financial records, supporting documents, statistical records, and all other records pertinent to a Federal award be retained to support amounts reported. The OMB Compliance Supplement identifies Reporting as a compliance requirement for this program and requires that financial reports be supported by underlying accounting records and subject to appropriate review prior to submission. Condition: During our audit, we noted that financial reports submitted to the Federal awarding agency were not consistently supported by retained documentation demonstrating how reported amounts were calculated. In addition, there was no documented evidence of supervisory review or approval of the reports prior to submission. During interim testing of reports, we noted that certain periodic financial reports submitted to the pass-through entity did not reconcile to the Organization’s general ledger at the time of submission. The variances were attributable to journal entries, voided checks, and other posting adjustments recorded after report submission. While cumulative and final reports ultimately agreed to the Organization’s accounting records and no amended reports were required, documentation reconciling the differences at the time of submission was not retained. documentation was retained for amounts reported to the Federal awarding agency or to require documented supervisory review of reports prior to submission. Effect or Potential Effect: The absence of supporting documentation and independent review increases the risk that inaccurate, incomplete, or unsupported information could be reported to the Federal awarding agency and not be detected in a timely manner. Although no questioned costs were identified as a result of our audit procedures, this deficiency creates a reasonable possibility that material noncompliance with reporting requirements could occur and not be prevented or detected on a timely basis. Questioned Costs: None. Repeat Finding: This is not a repeat finding. Recommendation: We recommend that management implement procedures to: Retain supporting documentation for all amounts reported to Federal awarding agencies, including reconciliations to the general ledger; Require documented supervisory review and approval of reports prior to submission; and Ensure that adjustments occurring after report submission are documented and, when necessary, corrected through revised reporting. Views of Responsible Officials and Planned Corrective Action: Management acknowledged that supporting documentation was not consistently retained and that supervisory review was not formally documented. Management has indicated that procedures will be implemented to ensure reports are reconciled to accounting records, properly supported, and reviewed prior to submission.
Finding 2024-001 - U.S. Department of Housing and Urban Development, Mortgage Insurance Rental and Cooperative Housing for Moderate Income Families and Elderly, Market Interest Rate, CFDA #14.135 Statement of Condition: Internal control processes over financial accounting did not ensure that all transactions were properly recorded. Internal control processes over financial accounting did not ensure that key accounts were reconciled or reviewed on a periodic basis. Criteria: The HUD Handbook 4370.2 REV-1, Chapter 2 requires the books and accounts to be complete and accurate. HUD Handbook 4370.2 REV-1, Chapter 2, Section 12 requires monthly reconciliations of all cash accounts. Additionally, 2 CFR Part 200 Section 200.302 Financial Management states that the financial management system of each non-federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award in accordance with the reporting requirements. Additionally, 2 CFR Part 200 Section 200.303(a), Internal Controls, requires that non-federal entities must establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the award in compliance with federal statutes, regulations and the terms and conditions. Effect: Noncompliance with HUD and Uniform Guidance requirements and the possibility of undetected material misstatements and/or undetected misappropriation of assets. Cause: Prior management oversight. Context: An understanding of processes and internal controls was performed with the Corporation's management and tests were performed to determine if the processes and internal controls were implemented and effective. As part of this process we noted the following processes and internal controls were not effective and/or implemented. 1) Only two of the six bank accounts were reconciled. The outsourced bookkeeper only performed a bank reconciliation for the operating and security deposit cash accounts. 2) The accounts receivable, tenants and accounts receivable, HUD were not reconciled. 3) The monthly review process of the Corporation's financial information is not fully supported by evidence of such review. Questioned Costs: N/A Recommendation: We recommend management review/enhance its accounting and internal control procedures to ensure that all key accounts are reconciled and reviewed with supporting evidence of such review. Views of Responsible Officials and Corrective Action Plan: Management agrees with the finding and will review the accounting and financial procedures, system of internal controls and policies. The Corporation has executed a new management agreement with Remnant Management Inc. effective October 1, 2024. Remnant Management Inc. will ensure that all transactions are properly recorded and that key accounts are reconciled and reviewed on a periodic basis beginning October 1, 2024 and going forward.
Subject: Section 8 Housing Choice Voucher Program Federal Agency: Department of Housing and Urban Development Federal Program: Section 8 Housing Choice Vouchers Assistance Listing Number: 14.871 Federal Award Number and Year (or Other Identifying Number): CY 2024 Pass-Through Entity: Not applicable Compliance Requirement: Allowable Costs Audit Finding: Significant Deficiency Condition and Context: During the review of disbursements, it was noted the Housing Authority does not consistently document approval of disbursements prior to payment. Our sample of cash disbursements revealed that checks and electronic payments were processed without evidence of review or authorization by management. Criteria: Per 2 CFR §200.302(b)(3), non-Federal entities must maintain effective internal control over Federal awards that provides reasonable assurance that charges to Federal programs are allowable, allocable, and in compliance with laws, regulations, and the provisions of contracts or grant agreements. Additionally, sound internal control practices require that disbursements be reviewed and approved to ensure they are valid, properly supported, and in compliance with program requirements. Cause: The Authority has not implemented procedures requiring documented review and approval of disbursements before payment is made. Effect: Without documented approval of disbursements, there is an increased risk of unauthorized, unsupported, or unallowable expenditures. Questioned Cost: Known and projected misstatement: None Recommendation: The Housing Authority should implement policies and procedures that require all disbursements to be approved by the Board prior to checks being issued.
FINDING 2024‐001 – Allowable Cost Principles and Activities Allowed or Unallowed Material Weakness in Internal Control over Compliance Assistance Listing Number: 21.029 Federal Program Name: COVID-19 - Coronavirus Capital Projects Fund Award Year: 2024 Criteria: Uniform Guidance requires non-Federal entities to establish and maintain effective internal controls over Federal awards, including ensuring transactions are properly recorded, reported, and allowable. Specifically: • 2 CFR §200.302(b)(1) and (b)(2) require financial management systems to provide accurate, current, and complete disclosure of financial results and to identify expenditures by Federal award. • 2 CFR §200.302(b)(6) requires written procedures for determining the allowability of costs. • 2 CFR §200.303 requires entities to establish and maintain effective internal controls over compliance, including appropriate segregation of duties. Condition and context: The Cooperative does not have formalized written policies and procedures governing the coding, review, and reporting of expenditures charged to Federal awards, including payroll costs. Additionally, adequate segregation of duties is not in place over the review and approval of expenditure coding and financial reporting. As a result, payroll expenditures were not consistently or timely coded to the appropriate grant. Payroll expenditures totaling $16,990 were identified subsequent to year-end and recorded and reported late. These costs were not included in the appropriate reporting period, resulting in delayed recognition of allowable expenditures. Questioned costs: None. Effect: The absence of formal policies, procedures, and proper segregation of duties increases the risk that expenditures are not accurately, completely, or timely recorded and reported by Federal award. This may result in: • Financial reports that do not reflect complete and accurate program expenditures for the reporting period; • Increased risk of noncompliance with Federal reporting requirements; • Potential misstatement or omission of allowable costs; and • Delays in reimbursement or increased risk of questioned costs. Additionally, the late identification and backdating of payroll expenditures contributed to the triggering of Single Audit requirements, which are now being performed after the required timeframe. Cause: The deficiencies are due to a lack of formalized written policies and procedures over expenditure coding, allowability determinations, and reporting, as well as inadequate segregation of duties in the preparation, review, and approval of grant-related expenditures and reports. Repeat finding: No Recommendation: We recommend the Cooperative develop and implement written policies and procedures to ensure timely, consistent, and correct coding of all grant-related expenditures (payroll and non-payroll). Within these policies and procedures, we recommend establishing review and approval controls, including periodic review of expenditure coding by supervisory or accounting personnel. Implementing these policies and procedures will ensure expenditures are recorded within the appropriate reporting period. Views of responsible officials and planned corrective actions: Wabash currently maintains informal procedures for coding and reviewing invoices and payroll records, management recognizes the need for a formalized, written policy governing expenditures charged to federal awards. To address identified material weaknesses, Wabash is committed to implementing a comprehensive written policy by June 30, 2026. This policy will formalize the coding, review, and reporting processes for all federal expenditures. Contact Person(s): Cheryl Gaither, Controller Justin Gephart, Chief Operating Officer
Finding No. 2024-001 Implement System-Based Tracking of Federal Expenditures Assistance Listing Number: 93.566 Program Name: Refugee and Entrant Assistance State/Replacement Designee Administered Programs Federal Agency: Department of Health and Human Services (HHS) Passed Through Entities: 1. California Department of Social Services 2. University of California, San Diego 3. California Rural Legal Assistance Foundation 4. San Diego Refugee Communities Coalition/United Women of East Africa Support Team 5. Public Health Institute (PHI) Federal Award Numbers: ALSP22-0002-A1, ALSP23-0001, PUR00533092, ACS22-05-CAIR, 06568-AR76924 Federal Award Year: August 1, 2022 to June 30, 2026 Compliance Requirement: Activities Allowed or Unallowed Criteria: Management is responsible for designing, implementing, and maintaining an internal control system that ensures accurate financial reporting. Effective internal control over financial reporting provides reasonable assurance regarding the completeness and accuracy of accounting records, and compliance with grantor requirements. 2 CFR 200.510 Financial Statements require auditees to prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee's financial statements. This schedule must include the total Federal awards expended, as determined in accordance with 2 CFR 200.502. The information presented should be consistent with the accounting records (i.e., general ledger). In addition, Section 2 CFR 200.302(b)(1) provides that non-Federal entities must maintain effective control over and accountability for all funds, and must identify, in their accounts, all Federal awards received and expended. Condition: During our review of the SEFA, we noted that CAIR-CA utilizes workbooks outside of its accounting software to track federal expenditures. The workbooks do not reconcile directly with the general ledger (GL), so management performs a separate reconciliation to support the SEFA amounts. This approach was similarly observed in the prior year's audit. Cause: The prior year audit was completed in August 2025, after the close of the fiscal year 2024. As a result, management was still in the process of implementing a system-based tracking during the year 2024. CAIR-CA’s processes for tracking federal awards are continuing to develop, as this is only the second year under Single Audit. Effect: Using manual workbooks requires additional manual effort and may make reconciliation between SEFA and GL more time-consuming, and may result in inaccurate or incomplete reporting. Questioned Cost: None Recommendation: We recommend that CAIR-CA continue enhancing its accounting processes to track federal expenditures directly within its accounting software. This could include GL tracking codes or other similar identifiers for federal programs. System based tracking would simplify SEFA preparation, improve consistency with the general ledger, and strengthen monitoring of federal expenditures. Views of Responsible Officials and Corrective Action Plan: Management concurs with the finding and has already updated the accounting system to incorporate grant-specific tracking codes to further align with federal reporting standards. Because the organization’s first single audit in FY2023 was conducted concurrently with the FY2024 single audit, there was limited opportunity for these procedural improvements to be reflected in the FY2024 single audit testing cycle. As a result, the impact of these changes will be more fully reflected in the FY2025 single audit, which is scheduled to commence this year. As part of a layered approach to internal controls, excel worksheets will continue to be used as a supplementary monitoring tool, providing an additional cross-check to the system-generated reports. Responsible person: Jackie Ramirez, Operations & Finance Associate Director Implementation date: November 20, 2025
Criteria: Per 2 CFR § 200.303(a), the non-Federal entity must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the entity is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the awards. Additionally, per 2 CFR §200.403 and §200.302, costs charged to federal awards must be allowable, allocable, and properly documented, and financial reporting must be accurate, complete, and supported by the accounting system. Condition: Although the Parish has implemented internal controls related to the allowability of costs and the preparation of required reports for the Coronavirus State and Local Fiscal Recovery funds, they were not operating effectively during fiscal year 2024. Tests of controls indicated that transactions were not tracked appropriately to ensure they were charged to the correct funding source. In addition, quarterly project and expenditure reports submitted to the U.S. Treasury included inaccurate or unsupported information due to a lack of tracking and reconciliation procedures. Cause: As discussed in item 2024-001, the Parish encountered several challenges during the transition of administration and key personnel. Parish administration and management were immediately tasked with enhancing operations related to procedural concerns from the prior administration and performing the accounting function without sufficient documentation on several balances and transactions. The documented controls were not in practice because of this. Effect: While no instances of noncompliance were noted, the lack of documented controls in practice increases the risk that future required reports could be incomplete, inaccurate, or untimely, as well as, federal costs being unallowed per the cost principles which could potentially result in program noncompliance. Recommendation: We recommend that the Parish enhance and document internal controls over financial reporting, as described in our recommendations described under item 2024-001, to prevent noncompliance of the Uniform Guidance as required. Views of responsible officials: See management’s responses to findings on Page 116.
Finding 2024-001, Expense Allocations - Financial Management (Assistance Listings 19.510, 93.566, 93.583 and 93.576) Criteria: Per 2 CFR § 200.302(a) (Financial Management), all recipient and subrecipient financial management systems must be sufficient to track expenditures and establish that funds have been used in accordance with federal statutes, regulations, and the terms and conditions of the federal award. Condition and Context: The Organization’s documentation related to the reconciliation of government grant revenue claimed and received to the actual revenue earned were not maintained. The lack of regular reconciliations increased the risk of misstatements in the financial records and delayed the financial reporting process. Cause: Internal controls over government grant revenue were not operating efficiently or designed properly. Effect: This resulted to significant amount of time required by both Management and the Auditors in order to analyze and adjust grant revenue, accounts receivables and deferred revenue balances accurately. Identification as a Repeat Finding: Yes. Questioned Costs: None. Recommendation: We recommend that the Organization strengthen its policies and procedures for reconciling the grant revenue earned to the related expenses. Financial reports and claims should be created from the reconciled general ledger. Additionally, management should establish clear documentation procedures to support the proper allocation of expenses in the general ledger and ensure compliance with federal regulations. View of responsible officials: Management has reviewed the finding and recommendations. We note that this item was identified as a repeat issue primarily due to the timing of the prior year's audit. Because the FY23 findings were delivered after FY24 had already concluded, the Organization did not have the opportunity to incorporate the auditors' feedback during the FY24 audited period. However, the Organization took immediate, proactive steps to deploy enhanced internal controls for FY25 to ensure continuous alignment with federal standards. To ensure strict adherence to 2 CFR § 200.302(a), we are actively implementing a more regular reconciliation process between government grant revenue claimed and actual revenue earned. As a key part of this initiative, the Organization has developed and deployed new internal financial tools designed to incorporate automation into our daily workflows. By utilizing these automated tools-such as standardized templates for recording cash receipts and systematically clearing Accounts Receivable-we have significantly enhanced the accuracy of our data entries and reduced the risk of manual misstatements. Our ongoing objective is to leverage these tools to establish clear, standardized documentation procedures, ensuring that all financial reports and claims are consistently generated from a reconciled general ledger. Management remains fully committed to dedicating the necessary time and resources to mature these financial controls and ensure robust compliance with federal regulations.
2 CFR § 1000.10 gives regulatory effect to the Department of Treasury for the following sections of 2 CFR 200: 2 CFR § 200.302(b)(7) requires written procedures for determining the allowability of costs in accordance with Subpart E-Cost Principles of this part and the terms and conditions of the Federal award. 2 CFR 200.320(b)(2)(ii) requires non-federal entities to have a written method for conducting technical evaluations of the competitive proposals received and for selecting contract recipients. 2 CFR 200.319(d) requires non-federal entities to have written procedures for procurement transactions to ensure all solicitations incorporate a clear and accurate description of the technical requirements for the property, equipment, or service to be procured and identify all requirements which the offerors must fulfill and all other factors to be used in evaluating bids or proposals. The Village was awarded grant monies under the Uniform Guidance (UG); however, the Village did not establish formal written policies required by the UG for the sections listed above. A lack of policies could result in inadequate guidance for individuals to follow and ensure proper compliance. To help ensure compliance with the Uniform Guidance requirements, the Village should establish and maintain timely updated policies and, more importantly, implement procedures as specified by UG requirements for all grant monies received. Any changes to the Village's policies should also be formally approved by Council and documented within the minutes.
NONCOMPLIANCE AND MATERIAL WEAKNESSES 2 CFR 1000.10 provides that, except for the deviations set forth elsewhere in this Part, the Department of Treasury adopts the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards set forth at 2 CFR Part 200. 2 CFR 200.302(b)(2) states, in part, the financial management system of each non-Federal entity must provide for accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. 2 CFR 200.329(c)(1) states that non-Federal entities must submit performance reports at the interval required by the Federal awarding agency or pass-through entity to best inform improvements in program outcomes and productivity. Per the City’s Ohio Department of Development Water and Wastewater Infrastructure Program Grant Agreement, program reports must be submitted by close of business, on the second Friday at the end of each quarter. Program reports must include the following information: a. Narrative summary of use of funds during the reporting period b. Narrative describing promoting equitable outcomes. Describe efforts used to promote equitable outcomes, including how projects were implemented with equity in mind. c. Narrative describing community engagement d. Labor Practices: Describe workforce practices on projects implemented. How is the project using strong labor standards to promote effective and efficient delivery of high quality infrastructure. e. Project Construction Start Date (if applicable) f. Project Operations date g. National Pollutant Discharge Elimination System (NPDES) Permit Number (if applicable) h. Public Water System (PWS) ID Number (if applicable) i. Information on Matching funds utilized during the reporting period (i.e., source, amount and uses) The City did not have proper internal controls in place to ensure the timely submission of the quarterly performance reports related to the Galalina & Harbor Area Sanitary Sewer Rehabilitation. We noted that the City did not file the first of the third quarterly reports as required by their grant agreement.Failure to have the proper controls in place to ensure the timely submission of the quarterly performance reports could result in the Treasury taking action against the City for failure to comply with programmatic requirements. The City should implement and have controls in place to ensure the quarterly performance reports are filed by the required due dates.
Incorrect Grant Drawdown – Allowable Costs / Reporting – Assistance Listing Numbers: 93.224 and 93.527 Consolidated Health Center Cluster Type of Finding: Material Weakness in Internal Control over Compliance Condition: During grant drawdown testing, it was noted that on December 6, 2024, management drew down $79,942 from the CARE Grant that related to expenditures attributable to the PREP Grant. No documentation or evidence of communication with the Health Resources and Services Administration (“HRSA”) was identified to demonstrate that the error was reported or corrected in a timely manner. This indicates that controls were not operating effectively to ensure grant drawdowns were made from the appropriate federal award. Criteria: Title 2 CFR §200.302 and §200.305 require non-Federal entities to maintain effective internal control over federal awards and ensure that drawdowns are limited to allowable costs incurred under the applicable award. Additionally, HRSA grant terms and conditions require recipients to request funds only for expenditures attributable to the specific grant award. Effect: Drawing funds from an incorrect federal award increases the risk of noncompliance with federal requirements and may result in unallowable costs, inaccurate reporting, or the need for repayment if not timely identified and corrected. Context: The exception noted represents a grant drawdown of $79,941.72 from the CARE Grant that was attributable to expenditures under the PrEP Grant, with no evidence of timely correction or notification to HRSA identified during audit testing. Questioned Costs: $79,942 Cause: Controls designed to ensure grant expenditures were properly aligned with the correct federal award prior to drawdown were not operating effectively, and procedures for identifying, reporting, and correcting drawdown errors were not consistently applied. View of Responsible Officials: Management agrees with the finding. Recommendation: We recommend that the Organization strengthen internal controls over grant drawdowns by implementing procedures to ensure expenditures are reviewed and reconciled to the appropriate federal award prior to requesting funds. Management should also establish formal procedures for timely identification, documentation, and communication of drawdown errors to the awarding agency when identified. Planned Implementation Date of Corrective Action: Fiscal Year 2026
Finding Number: 2024-008 Cash Management Cost reimbursement reports not maintained – Material weakness in internal controls, material noncompliance Assistance Listing Number: 93.193 Program Title: Urban Indian Health Services Federal Agency: U.S. Department of Health and Human Services Award Number: H722IHS0128-22-00 Pass-Through Entity: Indian Health Services Criteria: The Uniform Guidance at 2 CFR § 200.302(a) requires non-Federal entities to maintain financial management systems that provide accurate, current, and complete disclosure of financial results. Additionally, 2 CFR § 200.334 requires retention of financial records, including reports submitted to the grantor, for a period of three years. Condition: As a result of auditor testing, it was found that NACA did not retain copies of cost reimbursement reports submitted to the grantor for the Urban Health Clinic/Substance Abuse Prevention and Title V contracts. As a result, auditors were unable to verify amounts reported or reconcile reported amounts to NACA’s accounting records. Also, NACA did not have internal controls in place to ensure that copies of cost reimbursement reports submitted to the grantor for the Urban Health Clinic/Substance Abuse Prevention and Title V contracts were maintained for internal records. Cause: NACA lacked procedures to ensure that financial reports submitted for reimbursement were retained in accordance with Federal record retention requirements. Effect: Failure to retain cost reimbursement reports increases the risk of noncompliance with Federal requirements and limits NACA’s ability to support amounts requested for reimbursement. This also impacts transparency and auditability of financial activity. Recommendation: We recommend that NACA implement a process to ensure all cost reimbursement reports are retained and properly organized. This should include establishing a centralized recordkeeping system and periodic review procedures to confirm completeness of financial reporting documentation. Views of responsible officials: NACA concurs with the recommendation.
Finding Number: 2024-009 Reporting Performance reports not maintained- Material weakness in internal controls, material noncompliance Assistance Listing Number: 93.193 Program Title: Urban Indian Health Services Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: Indian Health Services Criteria: The Uniform Guidance at 2 CFR § 200.302(a) requires non-Federal entities to maintain financial management systems that provide accurate, current, and complete disclosure of financial results for each Federal award. In addition, non-Federal entities must ensure required programmatic (performance) reports are supported by appropriate documentation. Condition: As a result of auditor testing, it was found that NACA did not maintain adequate supporting documentation for performance-related reports submitted to the grantor for the Title V program. Cause: During the year ended December 31, 2024, NACA had limited administrative resources and lacked formal procedures to ensure that performance reporting documentation was retained and properly organized. Effect: Without sufficient supporting documentation, NACA is at increased risk of noncompliance with Federal reporting requirements, and there is reduced transparency and accountability over reported program performance. Recommendation: We recommend that NACA strengthen internal controls over performance reporting by implementing procedures to retain supporting documentation for all submitted reports and establishing a review process to ensure completeness and accuracy. Views of responsible officials: NACA concurs with the recommendation.
2 CFR § 1000.10 provides that, except for the deviations set forth elsewhere in this Part, the Department of Treasury adopts the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards set forth at 2 CFR Part 200. CFR § 200.302(a) states, in part, the non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions ; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award.. 2 CFR § 200.302(b)(2) states, in part, the financial management system of each non-Federal entity must provide for accurate, current, and complete disclosures of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. 2 CFR § 200.329(c)(1) further states, in part, the recipient or subrecipient must submit performance reports as required by the Federal award. Intervals must be no less frequent than annually nor more frequent than quarterly except if specific conditions are applied set forth in § 200.208. Additionally, the Ohio Department of Development (ODOD) Water and Wastewater Infrastructure Program Grant Agreement provides in Exhibit II that "Program reports must be submitted on a quarterly basis. Program reports must be submitted by close of business, on the second Friday at the end of each quarter.” Due to deficiencies in the City’s internal controls over reporting, the City did not submit quarterly program reports for any quarter in 2024. Failure to submit required quarterly program reports could result in the City not receiving the reimbursements that it is entitled to as well as adversely impact future grant awards. The City should implement internal controls to help ensure that reports are submitted by the required deadlines per reporting requirements.
2024-005 Internal Controls over Grant Management (Significant Deficiency and Noncompliance) (repeat finding 2023-005) Criteria: 2 CFR 200.302 establishes the requirements of a financial management system adequate to ensure compliance with federal regulations. This system must include written procedures to implement requirements for payment methods and determine the allowability of costs in accordance with subpart E. Statement of Condition: The City has written fiscal policies but they do not meet the financial management system requirements established in the regulations. Cause: The City has processes and procedures in place to administer grant funds but written policies do not contain compliance requirements. Effect: The City is not in compliance with financial management system requirements. Recommendation: The City should develop a grants manual or additional written policies to incorporate all the requirements of 2 CFR 200 and ensure compliance. Views of Management and Planned Corrective Action: See Corrective Action Plan included at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-006 – Activities Allowed (Significant Deficiency and Noncompliance)(Repeat Finding) Information on the Federal Program: U.S. Department of Veterans Affairs, Assistance Listing #64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure funds have been used in accordance with Federal statues, regulations, and terms and conditions of the Federal award. These requirements include that the nonfederal entity compare expenditures with the approved award budget. Condition: We tested 22 nonpayroll disbursements; one of those expenses did not fit into an expense category in the approved award budget. Cause: The Council began allocating non-reimbursable expenses to their grant codes to track the true costs of running a program. This grant allowed for indirect costs; however, these costs were charged directly to the grant and were included in the amount requested for reimbursement and also in the cost base used for the indirect cost calculation. These costs were not in line with the categories of expenses in the award budget. Effect: The Council allocated costs that were not allowable activities per the grant budget. Questioned Costs: $255 Recommendation: We recommend the Council strengthen procedures over costs invoiced for reimbursement to ensure those costs are compared to the grant budget for allowability. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Item 2024-001 Uniform Guidance Written Policies, Procedures and Standards of Conduct U.S. Department of Treasury COVID-19 Coronavirus State and Local Fiscal Recovery Funds Listing #21.027 Year Ended September 30, 2024 Criteria – Grantees should have written policies, procedures, and standards of conduct as required by 2 CFR 200, Subparts D & E of the Uniform Guidance. 2 CFR 200, Subparts D & E requires the non-Federal entity to establish and maintain written policies, procedures, and standards of conduct including internal controls over the Federal awards that provides reasonable assurance that the non‐Federal entity is managing the Federal statutes, regulations, and the terms and conditions of the Federal award. Specific requirements relate to the following: • § 200.302 Financial management • § 200.305 Payment Condition – The City does not have written policies, procedures and standards of conduct. Cause – The entity has failed to prepare written policies, procedures, and standards of conduct as required by 2 CFR 200, Subparts D & E of the Uniform Guidance. Questioned Costs – None noted Effect – Lack of written policies, procedures, and standards of conduct could result in noncompliance related to federal awards. Recommendation – We recommend that the Commission prepare written policies, procedures, and standards of conduct to include all the required elements as provided in 2 CFR 200, Subparts D & E of the Uniform Guidance. Management’s Response – The City is evaluating the auditor’s recommendations and will implement the necessary corrective action based on a cost benefit analysis.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.