2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.
2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.
2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.
2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent. The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.