DRINKING WATER STATE REVOLVING FUND – 66.468 Federal Awarding Agency: Environmental Protection Agency (EPA) Federal Award Fiscal Years: 2022 - 2030 Federal Award Numbers: 99126120, 99126122, 99126E22, 99126S22, 99126L22, 99126123, 99126E23, 99126S23, 99126121, 99126L23 Pass-through Entity: Rhode Island Infrastructure Bank (RIIB) Administered by: Rhode Island Department of Health (RIDOH) EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 - 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER ALLOCATION OF INDIRECT COSTS Controls are inadequate to ensure allocation of indirect costs is accurate, complete and in compliance with federal regulations. Background: RIDOH has constructed comprehensive workbooks, Uniform Grant Spreadsheets (UGS), to assist in monitoring award activity throughout the period of performance. Agency staff populate the UGS workbooks monthly with transactional information from the State’s accounting system. Accounting detail contained in the UGS are utilized to determine the indirect costs allocable to direct expenditures. Populating the spreadsheets is a manual process and lacks the required access, data integrity and other monitoring controls necessary to ensure the accuracy of the recording activity and subsequent calculations contained within. Criteria: Federal regulations 2 CFR §200.303 and 45 CFR §75.303 require the auditee to establish, document and maintain effective internal control over Federal awards that provides reasonable assurance the recipient is managing Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. Additionally, Federal regulation 2 CFR Part 200, Appendix VII specifically excludes capital expenditures as part of the direct expenditure base used in computing the indirect costs. Condition: Internal control over the allocation of indirect costs was insufficient to ensure compliance with federal regulations, specifically: • Indirect costs were erroneously applied to capital expenditures relating to improvements of the State’s Medical Examiner’s building, resulting in questioned costs of $160,132. • Data entry errors in the ELC Enhancing Detection award workbook resulted in the incorrect indirect cost rate applied retroactively to fiscal 2021. In considering total questioned costs, we calculated the impact of the incorrect indirect cost rate applied over the duration of the award to determine total questioned costs of $989,825. Cause: Current controls are not adequate (1) to detect the inclusion of unallowable costs within the indirect cost allocation calculation and (2) to ensure that the approved indirect cost rate is properly applied. The maintenance of the UGS monthly transactional detail is highly manual and lacks the data integrity controls to properly monitor for completeness, accuracy and required compliance with federal regulations. Effect: Reimbursement for unallowable indirect costs. Questioned Costs: $1,149,957 (ELC – 93.323) Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-045a Enhance internal controls over the UGS to ensure only allowable costs are included in the calculation of indirect costs and that only the approved indirect cost rate is applied. 2024-045b Credit the federal grantor for unallowable costs charged to the ELC grant award.
DRINKING WATER STATE REVOLVING FUND – 66.468 Federal Awarding Agency: Environmental Protection Agency (EPA) Federal Award Fiscal Years: 2022 - 2030 Federal Award Numbers: 99126120, 99126122, 99126E22, 99126S22, 99126L22, 99126123, 99126E23, 99126S23, 99126121, 99126L23 Pass-through Entity: Rhode Island Infrastructure Bank (RIIB) Administered by: Rhode Island Department of Health (RIDOH) EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 - 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER ALLOCATION OF INDIRECT COSTS Controls are inadequate to ensure allocation of indirect costs is accurate, complete and in compliance with federal regulations. Background: RIDOH has constructed comprehensive workbooks, Uniform Grant Spreadsheets (UGS), to assist in monitoring award activity throughout the period of performance. Agency staff populate the UGS workbooks monthly with transactional information from the State’s accounting system. Accounting detail contained in the UGS are utilized to determine the indirect costs allocable to direct expenditures. Populating the spreadsheets is a manual process and lacks the required access, data integrity and other monitoring controls necessary to ensure the accuracy of the recording activity and subsequent calculations contained within. Criteria: Federal regulations 2 CFR §200.303 and 45 CFR §75.303 require the auditee to establish, document and maintain effective internal control over Federal awards that provides reasonable assurance the recipient is managing Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. Additionally, Federal regulation 2 CFR Part 200, Appendix VII specifically excludes capital expenditures as part of the direct expenditure base used in computing the indirect costs. Condition: Internal control over the allocation of indirect costs was insufficient to ensure compliance with federal regulations, specifically: • Indirect costs were erroneously applied to capital expenditures relating to improvements of the State’s Medical Examiner’s building, resulting in questioned costs of $160,132. • Data entry errors in the ELC Enhancing Detection award workbook resulted in the incorrect indirect cost rate applied retroactively to fiscal 2021. In considering total questioned costs, we calculated the impact of the incorrect indirect cost rate applied over the duration of the award to determine total questioned costs of $989,825. Cause: Current controls are not adequate (1) to detect the inclusion of unallowable costs within the indirect cost allocation calculation and (2) to ensure that the approved indirect cost rate is properly applied. The maintenance of the UGS monthly transactional detail is highly manual and lacks the data integrity controls to properly monitor for completeness, accuracy and required compliance with federal regulations. Effect: Reimbursement for unallowable indirect costs. Questioned Costs: $1,149,957 (ELC – 93.323) Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-045a Enhance internal controls over the UGS to ensure only allowable costs are included in the calculation of indirect costs and that only the approved indirect cost rate is applied. 2024-045b Credit the federal grantor for unallowable costs charged to the ELC grant award.
DRINKING WATER STATE REVOLVING FUND – 66.468 Federal Awarding Agency: Environmental Protection Agency (EPA) Federal Award Fiscal Years: 2022 - 2030 Federal Award Numbers: 99126120, 99126122, 99126E22, 99126S22, 99126L22, 99126123, 99126E23, 99126S23, 99126121, 99126L23 Pass-through Entity: Rhode Island Infrastructure Bank (RIIB) Administered by: Rhode Island Department of Health (RIDOH) EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 - 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER ALLOCATION OF INDIRECT COSTS Controls are inadequate to ensure allocation of indirect costs is accurate, complete and in compliance with federal regulations. Background: RIDOH has constructed comprehensive workbooks, Uniform Grant Spreadsheets (UGS), to assist in monitoring award activity throughout the period of performance. Agency staff populate the UGS workbooks monthly with transactional information from the State’s accounting system. Accounting detail contained in the UGS are utilized to determine the indirect costs allocable to direct expenditures. Populating the spreadsheets is a manual process and lacks the required access, data integrity and other monitoring controls necessary to ensure the accuracy of the recording activity and subsequent calculations contained within. Criteria: Federal regulations 2 CFR §200.303 and 45 CFR §75.303 require the auditee to establish, document and maintain effective internal control over Federal awards that provides reasonable assurance the recipient is managing Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. Additionally, Federal regulation 2 CFR Part 200, Appendix VII specifically excludes capital expenditures as part of the direct expenditure base used in computing the indirect costs. Condition: Internal control over the allocation of indirect costs was insufficient to ensure compliance with federal regulations, specifically: • Indirect costs were erroneously applied to capital expenditures relating to improvements of the State’s Medical Examiner’s building, resulting in questioned costs of $160,132. • Data entry errors in the ELC Enhancing Detection award workbook resulted in the incorrect indirect cost rate applied retroactively to fiscal 2021. In considering total questioned costs, we calculated the impact of the incorrect indirect cost rate applied over the duration of the award to determine total questioned costs of $989,825. Cause: Current controls are not adequate (1) to detect the inclusion of unallowable costs within the indirect cost allocation calculation and (2) to ensure that the approved indirect cost rate is properly applied. The maintenance of the UGS monthly transactional detail is highly manual and lacks the data integrity controls to properly monitor for completeness, accuracy and required compliance with federal regulations. Effect: Reimbursement for unallowable indirect costs. Questioned Costs: $1,149,957 (ELC – 93.323) Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2024-045a Enhance internal controls over the UGS to ensure only allowable costs are included in the calculation of indirect costs and that only the approved indirect cost rate is applied. 2024-045b Credit the federal grantor for unallowable costs charged to the ELC grant award.
TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2301RITANF; 2401RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – Income Eligibility and Verification System INCOME ELIGIBILITY AND VERIFICATION SYSTEM Internal controls are lacking to ensure that Income Eligibility Verification System (IEVS) requirements are supported by documentation required by program regulations. Documentation deficiencies, specifically relating to executing data exchange interfaces, resulted in noncompliance with federal requirements for fiscal 2024. Background: RIBridges is the State’s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. Criteria: 2 CFR §200.303 requires that a non-federal entity must “establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Federal regulation 45 CFR §205.55 requires that “each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Social Security Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows (42 USC 1320b-7; 45 CFR §205.55): (a.) Wage information from the state Wage Information Collection Agency (SWICA) should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b.) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c.) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d.) Information from the US Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e.) Unearned income from the Internal Revenue Service (IRS).” Condition: The Department of Human Services (DHS) did not outline within its TANF state plan how it complies with Section 1137 of the Social Security Act as amended as it relates to IEVS requirements. Furthermore, the case files reviewed in the RIBridges system lacked sufficient documentation to demonstrate that income data interfaces were consistently executed for certain cases tested. This raises concerns regarding the adequacy of verification processes and compliance with federal program integrity requirements. As part of our sample testing of 71 cases subject to IEVS requirements, we identified the following issues: • In 5 cases, SWICA data from the Rhode Island Department of Labor and Training was available; however, no actions were taken to verify or incorporate this information into the benefit calculation process. • In 5 cases, none of the required IEVS data interfaces had been executed or documented in the case files. • In 21 cases, the IRS data interface was either not executed or reflected outdated information. • In 9 cases, the SSA data interface was either not executed or reflected outdated information. Cause: Absence of IEVS procedures documented within the TANF state plan. Lack of supporting documentation in the case record and insufficient procedures to ensure that income interfaces are run against client information prior to and during eligibility periods. Effect: Noncompliance with TANF IEVS requirements mandated by federal regulations. Improper or incorrect benefit payments could be claimed to the TANF program. Questioned Costs: Undetermined Valid Statistical Sample: Yes RECOMMENDATIONS 2024-050a Conduct a review of the TANF state plan and update it to include detailed procedures for utilizing IEVS interfaces and incorporating the resulting information into eligibility determinations. 2024-050b Ensure that income data interfaces are properly executed and that the information obtained is used in making benefit eligibility determinations.
TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2301RITANF; 2401RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – Income Eligibility and Verification System INCOME ELIGIBILITY AND VERIFICATION SYSTEM Internal controls are lacking to ensure that Income Eligibility Verification System (IEVS) requirements are supported by documentation required by program regulations. Documentation deficiencies, specifically relating to executing data exchange interfaces, resulted in noncompliance with federal requirements for fiscal 2024. Background: RIBridges is the State’s federally approved computer system used to manage multiple health care and human service programs. It was designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. Criteria: 2 CFR §200.303 requires that a non-federal entity must “establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Federal regulation 45 CFR §205.55 requires that “each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Social Security Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows (42 USC 1320b-7; 45 CFR §205.55): (a.) Wage information from the state Wage Information Collection Agency (SWICA) should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b.) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c.) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d.) Information from the US Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e.) Unearned income from the Internal Revenue Service (IRS).” Condition: The Department of Human Services (DHS) did not outline within its TANF state plan how it complies with Section 1137 of the Social Security Act as amended as it relates to IEVS requirements. Furthermore, the case files reviewed in the RIBridges system lacked sufficient documentation to demonstrate that income data interfaces were consistently executed for certain cases tested. This raises concerns regarding the adequacy of verification processes and compliance with federal program integrity requirements. As part of our sample testing of 71 cases subject to IEVS requirements, we identified the following issues: • In 5 cases, SWICA data from the Rhode Island Department of Labor and Training was available; however, no actions were taken to verify or incorporate this information into the benefit calculation process. • In 5 cases, none of the required IEVS data interfaces had been executed or documented in the case files. • In 21 cases, the IRS data interface was either not executed or reflected outdated information. • In 9 cases, the SSA data interface was either not executed or reflected outdated information. Cause: Absence of IEVS procedures documented within the TANF state plan. Lack of supporting documentation in the case record and insufficient procedures to ensure that income interfaces are run against client information prior to and during eligibility periods. Effect: Noncompliance with TANF IEVS requirements mandated by federal regulations. Improper or incorrect benefit payments could be claimed to the TANF program. Questioned Costs: Undetermined Valid Statistical Sample: Yes RECOMMENDATIONS 2024-050a Conduct a review of the TANF state plan and update it to include detailed procedures for utilizing IEVS interfaces and incorporating the resulting information into eligibility determinations. 2024-050b Ensure that income data interfaces are properly executed and that the information obtained is used in making benefit eligibility determinations.
CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER SPECIAL EDUCATION SERVICES PROVIDED BY LOCAL EDUCATION AGENCIES The Executive Office of Health and Human Services (EOHHS) needs to formalize and document internal control procedures to ensure local education agency (LEA) compliance with Medicaid requirements relating to the allowability of special education services. Criteria: 2 CFR §200.303 Internal controls, requires the State to “(a) establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), (b) comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award, (c) evaluate and monitor the recipient's or subrecipient's compliance with statutes, regulations, and the terms and conditions of Federal awards, and (d) take prompt action when instances of noncompliance are identified.” Condition: EOHHS did not conduct periodic site visits to LEAs during fiscal 2024. EOHHS has well established policies and procedures relating to its oversight of special education services which are detailed in Direct and Administrative Services Guidebooks for LEAs. Without periodic site visits or other documented control procedures designed to ensure local education agency compliance with the Medicaid policies and procedures that define the requirements for the allowability of special education services, internal controls are currently lacking over compliance in this area. In formalizing internal controls, EOHHS will be able to define the appropriate amount of oversight needed to ensure compliance with requirements for LEA special education services. Cause: Lack of documented internal controls over LEA direct and administrative claiming. Effect: Potential noncompliance with federal regulations regarding the allowability of special education services reimbursed by Medicaid. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-063 Document and implement internal controls to ensure the allowability of special education services for reimbursement by Medicaid.
CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER SPECIAL EDUCATION SERVICES PROVIDED BY LOCAL EDUCATION AGENCIES The Executive Office of Health and Human Services (EOHHS) needs to formalize and document internal control procedures to ensure local education agency (LEA) compliance with Medicaid requirements relating to the allowability of special education services. Criteria: 2 CFR §200.303 Internal controls, requires the State to “(a) establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), (b) comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award, (c) evaluate and monitor the recipient's or subrecipient's compliance with statutes, regulations, and the terms and conditions of Federal awards, and (d) take prompt action when instances of noncompliance are identified.” Condition: EOHHS did not conduct periodic site visits to LEAs during fiscal 2024. EOHHS has well established policies and procedures relating to its oversight of special education services which are detailed in Direct and Administrative Services Guidebooks for LEAs. Without periodic site visits or other documented control procedures designed to ensure local education agency compliance with the Medicaid policies and procedures that define the requirements for the allowability of special education services, internal controls are currently lacking over compliance in this area. In formalizing internal controls, EOHHS will be able to define the appropriate amount of oversight needed to ensure compliance with requirements for LEA special education services. Cause: Lack of documented internal controls over LEA direct and administrative claiming. Effect: Potential noncompliance with federal regulations regarding the allowability of special education services reimbursed by Medicaid. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-063 Document and implement internal controls to ensure the allowability of special education services for reimbursement by Medicaid.
CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER SPECIAL EDUCATION SERVICES PROVIDED BY LOCAL EDUCATION AGENCIES The Executive Office of Health and Human Services (EOHHS) needs to formalize and document internal control procedures to ensure local education agency (LEA) compliance with Medicaid requirements relating to the allowability of special education services. Criteria: 2 CFR §200.303 Internal controls, requires the State to “(a) establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), (b) comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award, (c) evaluate and monitor the recipient's or subrecipient's compliance with statutes, regulations, and the terms and conditions of Federal awards, and (d) take prompt action when instances of noncompliance are identified.” Condition: EOHHS did not conduct periodic site visits to LEAs during fiscal 2024. EOHHS has well established policies and procedures relating to its oversight of special education services which are detailed in Direct and Administrative Services Guidebooks for LEAs. Without periodic site visits or other documented control procedures designed to ensure local education agency compliance with the Medicaid policies and procedures that define the requirements for the allowability of special education services, internal controls are currently lacking over compliance in this area. In formalizing internal controls, EOHHS will be able to define the appropriate amount of oversight needed to ensure compliance with requirements for LEA special education services. Cause: Lack of documented internal controls over LEA direct and administrative claiming. Effect: Potential noncompliance with federal regulations regarding the allowability of special education services reimbursed by Medicaid. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-063 Document and implement internal controls to ensure the allowability of special education services for reimbursement by Medicaid.
CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5021, 2305RI3002; 2405RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2023; 2024 Federal Award Number: 2305RI5MAP; 2405RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER SPECIAL EDUCATION SERVICES PROVIDED BY LOCAL EDUCATION AGENCIES The Executive Office of Health and Human Services (EOHHS) needs to formalize and document internal control procedures to ensure local education agency (LEA) compliance with Medicaid requirements relating to the allowability of special education services. Criteria: 2 CFR §200.303 Internal controls, requires the State to “(a) establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), (b) comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award, (c) evaluate and monitor the recipient's or subrecipient's compliance with statutes, regulations, and the terms and conditions of Federal awards, and (d) take prompt action when instances of noncompliance are identified.” Condition: EOHHS did not conduct periodic site visits to LEAs during fiscal 2024. EOHHS has well established policies and procedures relating to its oversight of special education services which are detailed in Direct and Administrative Services Guidebooks for LEAs. Without periodic site visits or other documented control procedures designed to ensure local education agency compliance with the Medicaid policies and procedures that define the requirements for the allowability of special education services, internal controls are currently lacking over compliance in this area. In formalizing internal controls, EOHHS will be able to define the appropriate amount of oversight needed to ensure compliance with requirements for LEA special education services. Cause: Lack of documented internal controls over LEA direct and administrative claiming. Effect: Potential noncompliance with federal regulations regarding the allowability of special education services reimbursed by Medicaid. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2024-063 Document and implement internal controls to ensure the allowability of special education services for reimbursement by Medicaid.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.