Missing Receipt Support for MTW Public Housing Tenant Transactions (ALN 14.881) Condition: A review of tenant files under the Moving to Work (MTW) Public Housing program found that while the tenant files themselves were complete, the Authority did not provide supporting documentation for certain rent receipts. In several instances, the rent amounts recorded in the receipt or rent register did not agree with the amounts reported on HUD Form 50058, and no receipt documentation was available to reconcile the difference. Criteria: Under the MTW Operations Notice (85 FR 10232), 2 CFR §200.302, and HUD regulations at 24 CFR §960, public housing authorities must maintain complete and accurate records that support rent calculations, payments, and tenant eligibility. HUD Form 50058 must accurately reflect tenant rent obligations, and all payments must be properly documented and reconciled. Cause: The Authority did not maintain adequate documentation to support rent receipts and reconcile them with HUD Form 50058 data. Effect: The absence of receipt documentation impairs the Authority’s ability to demonstrate compliance with HUD requirements and increases the risk of rent misstatements, audit findings, and potential administrative sanctions. Questioned Costs: $125,170 Recommendation: The Authority should implement procedures to ensure all rent receipts are supported by appropriate documentation and reconciled to HUD Form 50058, provide staff training on documentation and recordkeeping requirements, and conduct periodic internal reviews of tenant files to verify that all payment records are complete and accurate. Reply and Corrective Action Plan: To address missing rent receipt documentation and inconsistencies with HUD Form 50058, the Authority will implement procedures to improve tenant file management, ensure all receipts are properly documented, and reconcile rent records to support accurate reporting and compliance.
Condition: Out of the 72 grant drawdowns during the year, 24 drawdowns were tested and it was noted that 1 of the drawdowns was made in advance of the supporting invoices being paid to the vendors and subsequently the invoices were not paid within the 72-hours, as required. Context: The auditor haphazardly selected 24 grant drawdowns from the population, which we consider to be a statistically valid sample size. The auditor reviewed the drawdowns and supporting documentation to ensure proper procedures are being followed and that the Agency is in compliance with HUD requirements. Criteria: The U.S. Treasury per 2 CFR section 200.305 (2 CFR section 200.302(b)(6)) requires grant funds received by the Authority to be properly spent within 72 hours of receipt. HUD regulations require that proper documentation be maintained for all Capital Fund Program per 24 CFR 905.326. Cause: The Agency experienced staff turnover in the finance department as well as difficulty replacing personnel knowledgeable with HUD and grant reporting requirements. Effect: The Agency did not disburse the capital funds in a timely manner for one of the draws made during the year. Questioned Costs: $40,500 Auditor’s Recommendations: The Agency should continue to develop and implement internal controls over grant management to coordinate capital fund draws with the timing of invoice payments. View of Responsible Officials: See Corrective Action Plan
2024-004 Type of Finding: Material Weakness in Internal Control over Compliance Federal Agency: Department of Housing and Urban Development Federal Program Name: Moving to Work Demonstration Program Assistance Listing Number: 14.881 Federal Award Identification Number and Year: WA005VOW089-WA005VOW094 – 2024 Pass-Through Agency: Pierce County Pass-Through Number: SC-110242 & SC-111165 Award Period: July 1, 2023 – June 30, 2024; July 1, 2024 – June 30, 2025 Criteria or Specific Requirement: 2 CFR 200.302(a) on Financial management states that “All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award". Condition: During Activities Allowed or Unallowed; Allowable Costs / Cost Principles testing, 3 of the 40 samples selected did not include sufficient documentation to support the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 3 samples. During Eligibility testing, 2 of the 8 samples selected did not include sufficient documentation to support the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. During Special Tests and Provisions testing, 2 of the 16 samples selected did not retain documentary evidence of compliance with the Rent Reasonableness and Housing Quality Standards requirements. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Questioned Costs: None Context: Activities Allowed or Unallowed; Allowable Costs / Cost Principles: A sample of 40 disbursements were taken from a population of over 250 individual charges to the major program. Of the 40 sampled, 3 were insufficiently supported to agree to the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 3 samples. Eligibility: A sample of 8 was made from a population of 63 major program participants. Of the 8 sampled, 2 had benefit costs that were insufficiently supported to agree to the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Special Tests and Provisions: A sample of 8 was made from a population of 63 major program participants, each with two Special Tests and Provisions requirements (Rent Reasonableness and Housing Quality Standards) for a total of 16 samples. Of the 8 participants sampled, 1 file did not include a Rent Reasonableness Checklist and Certification form nor a Housing Quality Standards Inspection form. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Cause: Support was not found during fieldwork, as source documentation related to payments made for program participants are inconsistently retained in the participant's files. Documentation should be ready for audit at the time of fieldwork. Effect: Without adequate documentation in place to ensure costs are evidenced and reconcile to the expenditures documented in the underlying accounting information that is used to prepare the SEFA, Associated Ministries of Tacoma - Pierce County could incorrectly charge expenditures to the federal program, or not request appropriate reimbursement that Associated Ministries of Tacoma - Pierce County is entitled to under the terms of the grant. Repeat Finding: No. Recommendation: CLA recommends that Associated Ministries of Tacoma - Pierce County implement a policy to retain all invoices, receipts, bills, and other similar source documents within each client file behind each Check Request form. In addition, program staff should retain a clear paper trail that documents the difference between monthly rent as specified on the lease agreements to the amount disbursed on behalf of the participant. This will enhance clarity of costs attributable to the major program. View of Responsible Officials: There is no disagreement with the audit finding.
2024-004 Type of Finding: Material Weakness in Internal Control over Compliance Federal Agency: Department of Housing and Urban Development Federal Program Name: Moving to Work Demonstration Program Assistance Listing Number: 14.881 Federal Award Identification Number and Year: WA005VOW089-WA005VOW094 – 2024 Pass-Through Agency: Pierce County Pass-Through Number: SC-110242 & SC-111165 Award Period: July 1, 2023 – June 30, 2024; July 1, 2024 – June 30, 2025 Criteria or Specific Requirement: 2 CFR 200.302(a) on Financial management states that “All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award". Condition: During Activities Allowed or Unallowed; Allowable Costs / Cost Principles testing, 3 of the 40 samples selected did not include sufficient documentation to support the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 3 samples. During Eligibility testing, 2 of the 8 samples selected did not include sufficient documentation to support the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. During Special Tests and Provisions testing, 2 of the 16 samples selected did not retain documentary evidence of compliance with the Rent Reasonableness and Housing Quality Standards requirements. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Questioned Costs: None Context: Activities Allowed or Unallowed; Allowable Costs / Cost Principles: A sample of 40 disbursements were taken from a population of over 250 individual charges to the major program. Of the 40 sampled, 3 were insufficiently supported to agree to the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 3 samples. Eligibility: A sample of 8 was made from a population of 63 major program participants. Of the 8 sampled, 2 had benefit costs that were insufficiently supported to agree to the amount charged to the major program. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Special Tests and Provisions: A sample of 8 was made from a population of 63 major program participants, each with two Special Tests and Provisions requirements (Rent Reasonableness and Housing Quality Standards) for a total of 16 samples. Of the 8 participants sampled, 1 file did not include a Rent Reasonableness Checklist and Certification form nor a Housing Quality Standards Inspection form. After fieldwork was completed, the client produced the necessary documentation for the 2 samples. Cause: Support was not found during fieldwork, as source documentation related to payments made for program participants are inconsistently retained in the participant's files. Documentation should be ready for audit at the time of fieldwork. Effect: Without adequate documentation in place to ensure costs are evidenced and reconcile to the expenditures documented in the underlying accounting information that is used to prepare the SEFA, Associated Ministries of Tacoma - Pierce County could incorrectly charge expenditures to the federal program, or not request appropriate reimbursement that Associated Ministries of Tacoma - Pierce County is entitled to under the terms of the grant. Repeat Finding: No. Recommendation: CLA recommends that Associated Ministries of Tacoma - Pierce County implement a policy to retain all invoices, receipts, bills, and other similar source documents within each client file behind each Check Request form. In addition, program staff should retain a clear paper trail that documents the difference between monthly rent as specified on the lease agreements to the amount disbursed on behalf of the participant. This will enhance clarity of costs attributable to the major program. View of Responsible Officials: There is no disagreement with the audit finding.
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Condition: A weakness existed in the overall reconciliation/tie-in procedures performed over the Tribe’s financial statement accounts for the fiscal year ended September 30, 2024. Financial accounts were either reconciled untimely or in some cases, accounts were not reconciled at all. Most of these accounts should be reconciled on a monthly basis. The major areas where reconciliation procedures were weak included: A) Beginning Balances B) Account Receivables C) Grant Receivables/Unearned Revenues D) Accounts Payable E) Payroll and Other Current Liabilities Criteria: OMB Uniform Guidance states the following in section 200.302, “(2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.327 Financial reporting and 200.328 Monitoring and reporting program performance. Cause: Lack of written policies and procedures over financial tie-in procedures that identify who is responsible for performing these tie-in/reconciliation procedures. Effect: In the course of performing the audit, the auditor recommended 20 adjusting journal entries be made to the financial statements for fiscal year ending September 30, 2024. Many of these adjustments could have been avoided if timely reconciliation and tie-in procedures had been conducted by the finance department. Many of these audit adjustments were material in nature. Recommendation: The Tribe should adopt written reconciliation and tie-in procedures into its financial policies and procedures manual. Views of Responsible Officials: See Corrective Action Plan
Earmarking Federal Agency: Department of Homeland Security Federal Program Name: Disaster Grant Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Grant Award Number: 4337DR-FL-2024 Award Period: Various Type of Finding: Material Weakness in Internal Control over Compliance and Other Matters Criteria: Compliance: 2 CFR 200.302(b)(3) states that records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the” Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Management costs requested and received from FEMA exceeded the 5% threshold. Questioned Costs: $35,572. Context: Received the total award amount for calculation of the 5% threshold. Compared to the management costs requested and received. Cause: The County requested management fees unaware of the total expenditure amount. Effect: Over request of management fees leads to unallowable costs. Repeat finding: No Recommendation: Provide clear, updated guidance and periodic training sessions on earmarking rules and how to apply them. Conduct reviews of earmarking compliance. View responsible official and planned corrective actions: New procedures will be implemented that strengthen internal controls to ensure clear earmarking guidance and initial review of compliances.
Federal Agency: Department of Homeland Security Federal Program Name: Disaster Grant Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Grant Award Number: 4337DR-FL-2024 Award Period: Various Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria: Compliance: 2 CFR 200.302(b)(3) states that records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the” Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: It was observed that quarterly progress reports lacked documentation of review and approval by management prior to submission to the granting agency. Questioned Costs: None. Context: All quarterly progress reports selected for testing lacked documented review and approval. Cause: The City has not established formal policies and procedures for the review and approval process. Effect: The lack of a proper review and approval process for grant quarterly progress report submissions can result in the submission of inaccurate and incomplete reimbursement requests and reports, which may lead to non-compliance with grant requirements and potential financial penalties. Repeat Finding: No Recommendation: We recommend that the organization implement a review and approval process for all quarterly progress report submissions. This should include: - Training staff on the importance of the review and approval process. - Ensuring adequate staffing levels to handle the review process. - Developing clear guidelines and procedures for the review and approval process. - Regularly monitoring and auditing the review process to ensure compliance. View of Responsible Official and Planned Corrective Actions: There is no disagreement with the audit finding. See Corrective Action Plan
Federal Agency: Department of Homeland Security Federal Program Name: Disaster Grant Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Grant Award Number: 4337DR-FL-2024 Award Period: Various Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria: Compliance: 2 CFR 200.302(b)(3) states that records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the” Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: It was observed that quarterly progress reports lacked documentation of review and approval by management prior to submission to the granting agency. Questioned Costs: None. Context: All quarterly progress reports selected for testing lacked documented review and approval. Cause: The City has not established formal policies and procedures for the review and approval process. Effect: The lack of a proper review and approval process for grant quarterly progress report submissions can result in the submission of inaccurate and incomplete reimbursement requests and reports, which may lead to non-compliance with grant requirements and potential financial penalties. Repeat Finding: No Recommendation: We recommend that the organization implement a review and approval process for all quarterly progress report submissions. This should include: - Training staff on the importance of the review and approval process. - Ensuring adequate staffing levels to handle the review process. - Developing clear guidelines and procedures for the review and approval process. - Regularly monitoring and auditing the review process to ensure compliance. View of Responsible Official and Planned Corrective Actions: There is no disagreement with the audit finding. See Corrective Action Plan
U.S. Department of Health and Human Services - 93.432 Center for Independent Living 2024-007 Missing Supporting Documentation for Federal Reimbursement Claims Criteria: Per 2 CFR §200.333 (now §200.334), financial records, supporting documents, statistical records, and all other records pertinent to a federal award must be retained for a period of three years from the date of submission of the final expenditure report. Furthermore, 2 CFR §200.302(b)(3) requires recipients to maintain records that adequately identify the source and application of funds for federally funded activities. Condition: During our audit of the Centers for Independent Living funded by the U.S. Department of Health and Human Services, we noted that the League did not retain adequate supporting documentation for reimbursement claims submitted during the year. Specifically, for October - December 2023 reimbursement claims tested, the actual claim forms submitted to the funding agency were missing. Cause: The missing documentation appears to have resulted from an inadequate document retention process and a lack of oversight in ensuring that federal claim records were properly filed and stored. Effect: The absence of supporting documentation for submitted claims limits the League’s ability to demonstrate compliance with federal requirements and increases the risk of questioned costs. It also impairs transparency and accountability for federal funds. Questioned Costs: $118,023 for October – December 2023 claims. Recommendation: We recommend the League strengthen its grant management procedures by implementing a centralized tracking system for grant expenditures and claims. Staff responsible for managing grants should receive training on claiming procedures and grant deadlines, and a periodic review of unclaimed eligible expenditures should be performed to ensure timely reimbursement. Views of Responsible Officials and Planned Corrective Actions: See corrective action plan on page 50.
2024-005 Internal Controls over Grant Management (Significant Deficiency and Noncompliance) (repeat finding 2023-005) Criteria: 2 CFR 200.302 establishes the requirements of a financial management system adequate to ensure compliance with federal regulations. This system must include written procedures to implement requirements for payment methods and determine the allowability of costs in accordance with subpart E. Statement of Condition: The City has written fiscal policies but they do not meet the financial management system requirements established in the regulations. Cause: The City has processes and procedures in place to administer grant funds but written policies do not contain compliance requirements. Effect: The City is not in compliance with financial management system requirements. Recommendation: The City should develop a grants manual or additional written policies to incorporate all the requirements of 2 CFR 200 and ensure compliance. Views of Management and Planned Corrective Action: See Corrective Action Plan included at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-005 Allowable Costs–Payroll Costs (Significant Deficiency and Noncompliance) (Repeat Finding) Information on the Federal Program: U.S. Department of Health and Human Services, Assistance Listing #93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure records adequately identify the source and application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Condition: We tested 32 payroll disbursements across five pay periods. Of those 32, 5 exceptions were noted. One exception was that the amount of time and corresponding amounts allocated to the grant did not agree to the percentage documented on the employee’s timesheet. For the other 4 exceptions, the supporting time sheets could not be provided for a pay period tested. Cause: Employee timesheets are turned in after payroll is processed and allocations made, the timesheet in this exception did not agree to the amount allocated. Four supporting time sheets for a January payroll processed could not be located. Effect: The Council did not retain proper documentation to support payroll costs charged to the grant. Questioned Costs: $729 Recommendation: We recommend the Council strengthen procedures surrounding payroll so that the source documentation agrees to and is retained to support the amounts being allocated to the grant based on actual employee time. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Finding 2024-006 – Activities Allowed (Significant Deficiency and Noncompliance)(Repeat Finding) Information on the Federal Program: U.S. Department of Veterans Affairs, Assistance Listing #64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program. Criteria: 2 CFR section 200.302 establishes the requirements for sufficient financial management over grant funding to ensure funds have been used in accordance with Federal statues, regulations, and terms and conditions of the Federal award. These requirements include that the nonfederal entity compare expenditures with the approved award budget. Condition: We tested 22 nonpayroll disbursements; one of those expenses did not fit into an expense category in the approved award budget. Cause: The Council began allocating non-reimbursable expenses to their grant codes to track the true costs of running a program. This grant allowed for indirect costs; however, these costs were charged directly to the grant and were included in the amount requested for reimbursement and also in the cost base used for the indirect cost calculation. These costs were not in line with the categories of expenses in the award budget. Effect: The Council allocated costs that were not allowable activities per the grant budget. Questioned Costs: $255 Recommendation: We recommend the Council strengthen procedures over costs invoiced for reimbursement to ensure those costs are compared to the grant budget for allowability. Views of Responsible Officials: See Management’s View and Corrective Action Plan at the end of the report.
Item 2024-001 Uniform Guidance Written Policies, Procedures and Standards of Conduct U.S. Department of Treasury COVID-19 Coronavirus State and Local Fiscal Recovery Funds Listing #21.027 Year Ended September 30, 2024 Criteria – Grantees should have written policies, procedures, and standards of conduct as required by 2 CFR 200, Subparts D & E of the Uniform Guidance. 2 CFR 200, Subparts D & E requires the non-Federal entity to establish and maintain written policies, procedures, and standards of conduct including internal controls over the Federal awards that provides reasonable assurance that the non‐Federal entity is managing the Federal statutes, regulations, and the terms and conditions of the Federal award. Specific requirements relate to the following: • § 200.302 Financial management • § 200.305 Payment Condition – The City does not have written policies, procedures and standards of conduct. Cause – The entity has failed to prepare written policies, procedures, and standards of conduct as required by 2 CFR 200, Subparts D & E of the Uniform Guidance. Questioned Costs – None noted Effect – Lack of written policies, procedures, and standards of conduct could result in noncompliance related to federal awards. Recommendation – We recommend that the Commission prepare written policies, procedures, and standards of conduct to include all the required elements as provided in 2 CFR 200, Subparts D & E of the Uniform Guidance. Management’s Response – The City is evaluating the auditor’s recommendations and will implement the necessary corrective action based on a cost benefit analysis.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.
Finding 2024-001—Significant Deficiency in Internal Controls over Compliance: Research and Development Cluster Program—Research and Development Cluster (R&D) Criteria—Compliance with the financial management and internal control requirements outlined in Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards; Sections 200.302-303 (“Section 200.302-303”) is required for all federal awards. Section 200.302-303 outlines the various requirements around documentation and internal controls. Condition and Context—Baystate Health’s internal controls over R&D allowable costs, special tests and provisions, and subrecipient monitoring in accordance with Section 200.302-303 were not appropriately designed and implemented or operated effectively. Specifically, during the 2024 audit, the following conditions were identified: • In instances, controls, as described below, exhibited the following: o Certain roles and responsibilities within the Sponsored Programs Administration (SPA) were inadequately defined and not understood by control owners o inconsistent documentation evidencing review over R&D compliance requirements o lack of a central repository for documentation related to the performance of internal control procedures and compliance with grant requirements o ineffective review of key personnel labor distributions o Insufficient internal review of grant budgets concerning the indirect cost rate and salary cap authorized for individual federal awards • The testing of internal controls over subrecipient monitoring identified an absence of underlying documentation. For three out of nine subrecipient selections there were no records maintained to document the completion and outcomes of the subrecipient risk assessment. For nine out of nine subrecipient selections there was no documentation retained evidencing Baystate Health’s review of subrecipient’s most recent audit information, or of Baystate Health’s review of the subrecipients’ compliance with registration, suspension and debarment requirements. • Testing of annual salary distribution requirements for key personnel documentation identified three out of 60 selections where the records were incomplete. These three selections account for two key personnel working within the oncology group. It was further identified that the total salary allocation of approximately $177 thousand for a total of four key personnel in the oncology group for fiscal year ended September 30, 2024, lacked underlying support substantiating the amounts allocated to federal grants. • The SPA intake form includes key grant data and is used for updating indirect cost rates in the general ledger system. For one out of 12 selections of indirect costs, testing identified that the indirect cost rate in the accounting system was outdated. The SPA intake form was initiated for the indirect cost rate changes but was not internally submitted in a timely manner. Consequently, the actual indirect cost was allocated at a lower rate than authorized. • Documentation evidencing internal review of monthly labor distribution and budget to actual reports was not maintained. Additionally, this monthly review failed to detect key personnel whose effort form was not properly set up for certification purposes. Seven out of 120 special tests selections were identified to have missing effort forms. These seven selections represent three key personnel actively working on federal grants. Management further identified a total of 89 key personnel lacking effort forms, among which 37 key personnel have actively contributed efforts to federal awards. • For 20 out of 60 National Institute of Health salary cap selections related to special tests and provisions, the salary cap rate used for the calculation of salary cap for individual personnel was outdated and did not align with the authorized salary cap rate in the grant agreement. This results from ineffective review of grant budgets for updated rate information. These control deviations when considered in the aggregate are indicative of a significant deficiency in the design, implementation, and operating effectiveness of the internal controls. Questioned Costs—none New Finding—No, repeat finding reference number 2023-001 Cause—Personnel responsible for internal controls over compliance related to R&D were not adequately aware of the documentation requirements of Section 200.302-303. Additionally, the internal control framework is not clearly defined and relies heavily on manual control processes that were inconsistently implemented and documented. Reviews were not performed at a precise enough level and on a timely basis. Effect—Failures in internal controls have the potential to result in instances of noncompliance with R&D grant requirements. Recommendation— The deficiencies in internal controls identified during the audit related to R&D indicates that the controls over compliance for R&D should be assessed and, where necessary, corrective action needs to be taken to enable Baystate Health to produce appropriate supporting documentation on a timely basis and maintain appropriate internal controls over all compliance requirements. Specifically, we recommend that: • The roles and responsibilities of the individuals involved in the SPA should be challenged to ensure that all critical functions are addressed; the distribution of responsibilities is appropriate; and positions include an element of cross‐training. The capabilities of the individuals and the level of resources should be assessed to make sure that they are consistent with the responsibilities assigned. • Policies and procedures should be developed, documented and maintained/updated for all significant grant-related activities. On-going monitoring should take place to assure that such policies and procedures are executed accurately. Internal controls could be enhanced by standardizing best practices and providing ongoing training regarding federal requirements over compliance and documentation. • A system should be implemented to maintain documentation related to internal controls and compliance requirements for federal grants in such a way that this documentation is easily accessible and clearly interpretated. • The process for calculating and reviewing salary cap requirements should be revised to include a check that the reports reviewed as part of the control process are complete and accurate. • Controls should be implemented consistently to facilitate a timely review of indirect cost rates at the time of initial execution and revision of grant budgets within the general ledger.