Finding 2026-002: Inadequate Subrecipient Monitoring – Failure to Evaluate Subrecipient Audit Findings Significant Deficiency in Internal Control over Compliance Federal Program Information • Federal agency: U.S. Department of Health and Human Services • Program: Temporary Assistance for Needy Families (TANF) • Assistance Listing Number - 93.558 • Compliance Requirement - Subrecipient Monitoring Criteria • 2 CFR 200.332(d)(4): The pass-through entity must review subrecipient audit findings to determine whether prompt and appropriate corrective action has been taken. • 2 CFR 200.332(f): The pass-through entity must ensure that subrecipients take timely and appropriate action on all deficiencies related to the federal award. • 2 CFR 200.303: The entity must establish and maintain effective internal control over federal awards. Condition The auditee obtained subrecipient Single Audit reports; however, there was no evidence that management: • Evaluated reported findings for relevance to the federal programs passed through. • Assessed the severity or potential impact of findings (e.g., material weaknesses, significant deficiencies, questioned costs). • Documented conclusions or follow-up on corrective actions. Cause The auditee did not have a formalized process or control requiring documented review and evaluation of subrecipient audit findings, including assignment of responsibility and supervisory oversight. Effect • The auditee may not identify or address subrecipient noncompliance affecting federal programs. • There is an increased risk that federal funds could be used in a manner inconsistent with compliance requirements. • Failure to ensure corrective action could result in questioned costs or federal sanctions. Questioned Costs None identified. Analysis / Auditor’s Perspective • While subrecipient audit reports were obtained, the absence of documented evaluation and follow-up indicates a breakdown in monitoring controls. Given that subrecipient monitoring is a key compliance requirement and the presence (or potential presence) of findings increases risk, this control deficiency is important enough to merit attention by those charged with governance but does not rise to the level of a material weakness, as no direct material noncompliance associated with the Organization’s pass-through funds or questioned costs were identified. Recommendation • Implement a standardized review process requiring documented evaluation of all subrecipient audit findings. • Develop a tracking mechanism for findings, corrective actions, and resolution status. • Assign responsibility for review and require evidence of supervisory approval. Views of Responsible Officials • Management agrees with the finding and its classification as a significant deficiency. • Management has begun developing a formal process through review of the Federal Audit Clearinghouse portal and inquiry and inspection of supporting pass-through grant detail to determine which organizations they pass-through funds to require single audits and to review any findings reported to determine if additional action as allowed under 2 CFR is necessitated. • Management has assigned responsibility to appropriate program personnel to carry out the detailed review and development of any action plans, if applicable, based on the results of subrecipient audits. • Management anticipates that the new procedures will be implemented and operating effectively by the end of the next fiscal year.
Item: 2026-001 Assistance Listing Numbers: 93.332 Program: Cooperative Agreement to Support Navigators in Federally-Facilitated Exchanges Federal Agency: U.S. Department of Health and Human Services Pass-Through Agencies: N/A Pass-Through Grantor Identifying Number: N/A Award Year: August 27, 2024 through August 26, 2029 Compliance Requirement: Subrecipient Monitoring Criteria: In accordance with 2 CFR 200.332 (e), (g) and (h) - pass-through entities must monitor subrecipient activity through reviewing financial and performance reports, verifying that subrecipients are audited if they meet the single audit criteria, and ensure that subrecipients take corrective action on single audit findings. Condition: AACHC implemented revised subrecipient monitoring procedures in October 2025 as part of its corrective action plan to address the prior-year finding. The revised procedures were applied to all active and new subrecipient agreements beginning October 2025. However, because certain subrecipient agreements had already concluded before the new procedures were implemented, AACHC did not retrospectively apply the monitoring process to those closed agreements. As a result, AACHC did not obtain and review financial statement audit or Single Audit reports for three subrecipients whose agreements ended prior to implementation of the revised procedures. Questioned Costs: N/A Context: AACHC had thirteen subrecipients subject to testing for subrecipient monitoring during the fiscal year, and all thirteen were selected for testing. Three of the thirteen subrecipients tested had agreements that ended before AACHC implemented revised subrecipient monitoring procedures in October 2025. For these three subrecipients, AACHC did not obtain and review the subrecipients’ audit or single audit reports and, therefore, did not determine whether any single audit findings required follow-up or corrective action. Based on the nature of the control deficiency and the extent of exceptions identified, this matter is considered a material weakness in internal control over compliance. Effect: AACHC did not obtain and review audit or Single Audit reports for certain subrecipients that received federal funding during the fiscal year and, therefore, did not determine whether any audit findings required follow-up or corrective action. As a result, AACHC lacked assurance that federal awards were administered in compliance with applicable federal requirements. Cause: The finding resulted from the timing of implementation of AACHC's revised subrecipient monitoring procedures. The procedures were established and implemented in October 2025 in response to the prior-year audit finding but were not applied to subrecipient agreements that had already ended before implementation. As a result, closed agreements were not evaluated for Single Audit applicability or related financial statement audit findings requiring follow-up. Identification of Repeat Finding: Repeat finding – See 2025-002. Recommendation: AACHC should enhance its subrecipient monitoring procedures to ensure that all subrecipients receiving federal funding during the fiscal year, including those whose agreement end before monitoring activities are performed, are evaluated for single audit applicability, have applicable audit reports obtained and reviewed, and receive appropriate follow-up on any audit findings. Views of responsible officials and planned corrective action: Management of AACHC concurs with the finding. See Corrective Action Plan.
Condition: We noted that the Foundation did not include all information required by Code of Federal Regulations (“CFR”) section 200.332 in subaward agreements selected for testing. Specific required information omitted from the subaward agreements included the following: the subrecipients unique entity identifier; the assistance listing title and number; identification of whether the federal award is for research and development; the indirect cost rate for the federal award; a specific statement stating that the subrecipient permits the pass-through entity & auditors to access the subrecipient's records and financial statements for the pass-through entity to fulfill its monitoring requirements; and appropriate terms and conditions concerning the closeout of the subaward. Criteria: CFR 200.332 requires specific language and informational content be included in all subaward agreements. Cause: The subaward agreements reference compliance with terms and conditions of the Foundation’s EDA grant agreement, rather than explicitly stating the subrecipient requirements, defined in CFR 200.332. Also, the policies and procedures manual of the Foundation does not include language requiring the inclusion of all specified information included in CFR section 200.332. Effect: Underlying executed subaward agreements are not in compliance with the Uniform Guidance and could lead to subrecipients not complying with all pertinent federal program requirements. Perspective Information: The errors were identified in two of the two items selected for testing from a total population of four. Recommendation: We recommend that the Foundation include required information in all future subaward agreements. We also recommend that the Foundation update their Policies and Procedures manual to reflect these current requirements and ensure proper inclusion in future subaward agreements. View of Responsible Officials and Planned Corrective Action: In agreement. The Foundation has begun issuing addenda to their existing subrecipient agreements to include the above information to ensure compliance with CFR section 200.332.
Finding Number: 2025-003 Federal Program: Coronavirus State and Local Fiscal Recovery Funds Federal Award Identification Number: 31-6400223 Assistance Listing Number (ALN): 21.027 Federal Awarding Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Pass-through Entity: Direct Award Repeat Finding: No Prior Audit Finding Number: N/A Significant Deficiency and Noncompliance – Subrecipient Monitoring Criteria Under 2 CFR § 200.332, pass-through entities are required to monitor the activities of subrecipients to ensure compliance with applicable federal statutes, regulations, and the terms and conditions of the subaward. This includes reviewing financial and performance reports, following up on deficiencies, and ensuring corrective action is taken. Condition During our testing of three subrecipient agreements, we noted that the City did not perform or document monitoring procedures for one subrecipient. Specifically, there was no evidence of review of financial reports, site visits, or other oversight activities for this subrecipient during the audit period. This condition only applies to subawards below a certain threshold, of which, the subrecipient activity is immaterial. For subawards above that threshold, the City utilizes a third-party consulting firm to perform subrecipient monitoring. The subawards tested that were monitored by the consulting firm did not indicate noncompliance. Cause The City does not have a consistent process in place to ensure all subrecipients are monitored in accordance with federal requirements. In this instance, monitoring procedures were either not performed or not documented. Effect Without proper monitoring, the City cannot ensure that subrecipients are using funds in compliance with program requirements. This increases the risk of noncompliance, improper use of funds, and undetected errors or irregularities. Recommendation We recommend the City implement and consistently follow formal subrecipient monitoring procedures. These should include documenting reviews of financial and performance reports, performing risk-based monitoring activities, and maintaining evidence of oversight for each subrecipient. Officials’ Response: See Corrective Action Plan.
Finding Number: 2025-004 Finding Type: Federal award finding Federal Assistance Listing No.: 15.685 Program Name: National Fish Passage Federal Agency: U.S. Department of the Interior Pass-Through Entity: n/a Grant Number: F24AC01768-00 Award Project Period: July 1, 2024 through July 1, 2029 Control Deficiency Type: Significant deficiency Instance of Noncompliance: Yes Compliance Requirement: Subrecipient monitoring Repeat Finding: No Criteria: Under 2 CFR 200.332 a pass-through entity must: • Evaluate each subrecipient’s risk of compliance to determine appropriate monitoring • Conduct monitoring activities based on risk, which may include reviewing financial and programmatic reports, following up on deficiencies, and verifying that subrecipients have required audits • Verify that subrecipients are not suspended or debarred prior to issuing a subaward • Ensure subrecipients submit required reports timely and comply with federal requirements • Include all applicable requirements imposed, including audit requirements under 2 CFR 200 Subpart F, the subaward • Issue management decisions for audit findings within 6 months of receiving the audit report Condition: The Council did not fully implement the required subrecipient monitoring procedures for its federal subaward. Specifically: • A formal written risk assessment was not performed prior to issuing the subaward. The Council relied on its prior working relationship with and knowledge of the subrecipient on non-federally funded projects rather than evaluating federal compliance risk. • Procurement and suspension/debarment verification were performed after the start of the subaward date. • Monitoring procedures performed were not thoroughly documented • The subaward did not include certain necessary language related the audit requirements under 2 CFR 200, Subpart F Cause: This is the Council’s first experience with awarding federal funds to a subrecipient. Staff relied on familiarity with the subrecipient rather than formalizing and documenting the required federal oversight steps. Effect: Without a documented risk assessment, timely debarment verification, documented monitoring activities, and required subaward language, the Council cannot fully demonstrate that it mitigated the risk of subrecipient noncompliance. This increases the likelihood that federal requirements may not be met or that noncompliance may go undetected. Questioned Costs: None. Audit Recommendation: The Council should strengthen its subrecipient monitoring processes by: • Developing and implementing a formal risk assessment process for all subrecipients of federal funds. • Performing and documenting suspension/debarment checks prior to issuing any subaward. • Reviewing its subaward requirements to ascertain that they include all the applicable requirements • Establishing monitoring procedures that include: • Tracking and reviewing required financial and programmatic reports for timeliness and completeness. • Obtaining and reviewing the subrecipient’s Single Audit or alternative audit documentation. • Issuing management decisions on findings within 6 months • Documenting follow up on any identified issue Management’s Response: Rogue River Watershed Council’s sub-recipient award in 2025 represents our first (and only) such award to date. While we don’t expect any sub-recipient awards in the near future, we will develop a set of procedures guiding such awards including the steps and the required timing for conducting a risk assessment, suspension/ debarment verification, required monitoring procedures, and the required language under 2 CFR 200, Subpart F. These procedures will be contained within a stand-alone policy for sub-recipient awards.
Federal Program Name: Research and Development Cluster: Uniformed Services University Medical Research Projects Federal Agency: U.S. Department of Defense Federal Assistance Listing Number: 12.750 Criteria or Specific Requirement: Subrecipient Monitoring Condition: During testing of subrecipient monitoring, it was noted that the Organization awarded three awards to subrecipients during the year and did not inform these subrecipients of the federal nature of the award at the time of the subaward. Specifically, the required federal award information was not included in the subaward documentation. Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance with federal requirements. Questioned Costs: None Context: In accordance with 2 CFR section 200.332(a), pass-through entities are required to clearly identify to the subrecipient the federal award information at the time of the subaward. This includes the federal award identification number, the federal awarding agency, the assistance listing number (ALN), and the amount of federal funds obligated. This information was not communicated to the subrecipients Cause: The Organization did not have adequate procedures in place to ensure that all required federal award information was communicated to subrecipients. Repeat Finding: Yes Recommendation: We recommend that the Organization implement procedures to ensure that all required federal award information is included in subaward agreements and communicated to subrecipients at the time of the award. Views of Responsible Officials and Planned Corrective Action: The Organization agrees with the comment and has revised policies to communicate all required federal award information to subrecipients.
Subrecipient Monitoring ALN 10:854: Rural Economic Development Loan and Grant Criteria: if the Cooperative serves as a passthrough entity, in accordance with 2 CFR 200.332 they must: • Clearly identify the award and applicable requirements to the subrecipient; • Monitor the activities of the subrecipient as necessary to ensure the subrecipient complies with federal requirements; • Verify that a subrecipient is audited. Condition: The Cooperative does not have written procedures that discuss subrecipients and how they will comply with the federal requirements as a passthrough entity, did not verify that the subrecipient was audited, and did not clearly identify to the subrecipient all the information required in the regulations. Context: There was a promissory note and loan agreement signed between the Cooperative and the subrecipient, and the agreement references to 2 CFR 200 via the incorporated Rural Economic Loan Agreement. Effect: The Cooperative is not fully following federal regulations regarding subrecipient monitoring. Questioned Costs: None. Cause: This is the first year the Cooperative received these loan funds, and written procedures were not in place prior to receiving the funds and not all of the requirements for pass through entities were followed. Auditor Recommendation: We recommend the Cooperative create procedures addressing the requirements in 2 CFR 200.332 and retain documentation showing that all required steps for passthrough entities were followed. Fergus Electric Cooperative Response: Fergus worked in conjunction and regularly communicated with the local Montana USDA REDL/G office to understand program requirements, provide requested information, and meet federal guidelines. Loan agreement RD 4280-5, (Dated 10/31/2024) refers to 7 CFR part 4280, Subpart A, as (“Regulations”). Fergus was unaware that 2 CFR 200 regulations are associated with 7 CFR part 4280, Subpart A. Fergus regretfully acknowledges that we were not informed or aware of obligations to meet the regulatory requirements within 2 CFR 200. Fergus has adopted and implemented a policy, Federal Funding Compliance, to establish formal procedures and ensure ongoing compliance with applicable federal regulations, including 7 CFR 4280, Subpart A and 2 CFR 200.
Federal Program Name: HOME Investment Partnerships Program Federal Agency: U.S. Department of Housing and Urban Development Assistance Listing Number: 14.239 Criteria Per 2 CFR 200.332, pass-through entities are required to evaluate each subrecipient’s risk of noncompliance to determine the appropriate level and type of monitoring, monitor the activities of the subrecipient to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and ensure subrecipients meet applicable program requirements, including financial and performance reporting and taking corrective action when issues are identified. Condition The City of Lafayette did not have formal, documented subrecipient monitoring policies in place during 2025, resulting in a lack of a consistent and structured monitoring framework. While the City performed several compensating controls (e.g., desk reviews, pre-disbursement reviews, and training), these activities were not formally defined or applied uniformly to ensure full compliance with Uniform Guidance. Cause The City has an agreement with Lafayette Housing Authority to administer and monitor the HOME program. Due to staff transitions during the year, the Authority relied on informal oversight procedures rather than implementing a structured monitoring plan, including risk-based assessments and documented monitoring activities. Effect The lack of formal subrecipient monitoring increases the risk that noncompliance with HOME program requirements may not be identified or corrected in a timely manner. Recommendation We recommend the Authority implement formal subrecipient monitoring procedures for the HOME program, including: • Performing and documenting annual risk assessments to determine the appropriate level of monitoring; • Conducting and documenting monitoring procedures (e.g., desk reviews and/or on-site reviews); and • Maintaining evidence of supervisory review and follow-up on any identified issues. Views of Responsible Officials and Planned Corrective Actions: For the views of responsible officials, refer to the Corrective Action Plan
Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: U.S. Department of the Treasury Assistance Listing Number: 21.027 Compliance Requirement: Subrecipient Monitoring Criteria: 2 CFR 200.332 establishes standards to evaluate subrecipient risk, monitor subrecipient activities, follow up on identified deficiencies, and maintain documentation of monitoring to ensure compliance with federal requirements Condition: The City of Noblesville does not have a formal policy or standardized process in place to track and perform consistent subrecipient monitoring procedures for all subrecipients receiving Coronavirus State and Local Fiscal Recovery Funds. Cause: The City has not established formal written procedures or implemented a centralized tracking mechanism to ensure all required subrecipient monitoring activities are performed and documented in accordance with federal requirements. Effect: Without a formal policy and tracking process, there is an increased risk that subrecipient monitoring procedures may not be performed consistently or timely, which could result in noncompliance with Uniform Guidance requirements and improper use of federal funds by subrecipients going undetected. Questioned costs: There were no identified questioned costs Context: We tested a sample of one subrecipient that received payments under the program totaling $249,857 of disbursements out of 4 total recipients, with total payments of $475,638 during 2025. Based on our procedures, we noted that the City has not established formal subrecipient monitoring procedures and that monitoring activities were not performed consistently across subrecipients. Our sampling methodology is not considered statistically valid. Recommendation: We recommend the City develop and implement a formal subrecipient monitoring policy and establish a centralized tracking system to ensure all required monitoring activities are performed consistently and documented for all subrecipients. The policy should align with 2 CFR 200.332 and include procedures for risk assessment, monitoring activities, and follow-up on identified issues. Views of Responsible Officials and Planned Corrective Actions: For the views of responsible officials, refer to the Corrective Action Plan
Federal Programs – AL 93.568 – Low Income Home Energy Assistance Program Criteria – Uniform Guidance requires, for any funds passed through to a subrecipient, that the pass-through entity (CAPND) must perform certain activities to ensure that the subrecipient uses the funds within provisions of the grant award and Uniform Guidance, 2 CFR sections 200.332 (b). This includes issuing subawards granted to subrecipients. Condition – For the year ended December 31, 2025, we reviewed any subawards between CAPND and subrecipients under the Low Income Home Energy Assistance Program (LIHEAP). We noted one subrecipient was missing a subaward during the year. Cause – There was one missing subaward between CAPND and the subgrantee. Effect – Increased risk of potential noncompliance with subrecipient monitoring requirements under Uniform Guidance. Questioned costs – None. Repeat Finding – This is not a repeat finding. Recommendation – The entity should include all required information as determined in CFR Section 200.332(b) in all subawards. Views of Responsible Officials - Management recognizes the deficiency and plans to implement the auditor’s recommendation.
Federal Award Identification: 2023-70417-39322 Federal Program: American Rescue Plan Technical Assistance Investment Program Assistance Listing: 10.234 Federal Agency: U.S. Department of Agriculture Pass-through Entity: Not applicable - direct award Award Period Audited: Fiscal year ended December 31, 2025 Criteria: 2 CFR 200.332(c) requires pass through entities to evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring. In addition, 2 CFR 200.332(e) requires pass through entities to monitor subrecipients to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward, including review of financial and performance information and follow up on identified issues. Condition: During the audit, it was determined that for all (2) subrecipients tested, the Organization did not document subrecipient risk assessments and, for one subrecipient tested, did not demonstrate that elevated risks were used to determine or adjust the nature, timing, or extent of subrecipient monitoring. Management identified one subrecipient as having recurring federal award findings, including material weaknesses reported in prior Single Audits. Despite this known elevated risk, the Organization applied the same baseline subrecipient monitoring procedures to all (2) subrecipients under the major program. Context: The deficiency was identified during audit testing of subrecipient monitoring controls and inquiry of management. Cause: The deficiency resulted from the absence of formal policies and procedures requiring documentation of subrecipient risk assessments and requiring that identified risks be used to determine and document the appropriate level of subrecipient monitoring. Effect: This significant deficiency in internal control over compliance created a reasonable possibility that material noncompliance with subrecipient monitoring requirements would not be prevented or detected on a timely basis. However, no instances of noncompliance were identified. Although no questioned costs were identified, the deficiency increased the risk that noncompliance could occur and remain undetected. Known Questioned Costs: None. Repeat Finding Status: This is a new finding for the year ended December 31, 2025. Recommendation: The Organization should implement formal, documented policies and procedures for risk-based subrecipient monitoring to ensure that monitoring activities are tailored based on subrecipient risk levels. This should include documented consideration of subrecipient audit results and retention of documentation supporting the performance and results of enhanced monitoring procedures for higher risk subrecipients. Views of Responsible Officials: Management agrees with the finding. Management acknowledges that subrecipient risk assessments were not formally documented and that monitoring activities were not adjusted based on identified risk levels. Management has indicated that corrective actions will be taken to implement a documented, risk based approach to subrecipient monitoring.
Finding 2025-001: Subrecipient Monitoring Significant Deficiency and Other Noncompliance Federal Program: USAID Foreign Assistance for Program Overseas (ALN 98.001) Federal Awarding Agency: United States Agency for International Development Awards: • Direct award: Resilient Coastal Community – 72065622CA00010 • Direct award: Urban Sanitation Activity – 72068724CA00001 • Pass-Through from UC Davis – A23-3500-S001 Criteria: 2 CFR 200.332 lists requirements for pass-through entities to perform as part of the subrecipient monitoring compliance requirement. This includes performing an evaluation of fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring procedures. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. 2 CFR 200.303 states that a receipt or subrecipient of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During fiscal year 2025, iDE passed federal funds to subrecipients under active federal awards that remained operational during a portion of the year prior to the termination of the underlying grant agreements. Although iDE reviewed subrecipient liquidation reports and reimbursement requests supporting expenditures incurred prior to award termination, iDE did not perform or document formal subrecipient risk assessments. Further, because risk assessments were not performed, iDE did not establish or implement monitoring procedures commensurate with assessed risk, such as documented reviews of performance information, follow-up on compliance matters, review of Single Audit reports, or other monitoring activities required by Uniform Guidance. Cause: Employee turnover and terminated programs. Effect: Inadequate procedures and controls for subrecipient monitoring could result in material noncompliance with applicable federal statutes, regulations, or award terms and conditions. Repeat finding: Yes—see Finding 2024-002. Questioned costs: None
Significant Deficiency – Lack of risk assessment over subrecipient Agency: Department of Health and Human Services ALN# 93.592 - Family Violence Prevention and Services/Discretionary Grants Grant Year: 2025 Grant Numbers: 90EV054301C6; 90EV052301C6; 90EV056003; 90EV0459-04 Criteria: Per 2 CFR §200.332(b), pass-through entities are required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward. This evaluation is necessary to determine the appropriate level of monitoring. Risk factors may include prior experience, results of previous audits, personnel or system changes, and results of federal monitoring. Condition: The Organization passed-through funding to two subrecipients without documenting a risk assessment over the entities’ possible noncompliance. Cause: Management has not established or implemented formal policies and procedures to ensure subrecipient risk assessments are performed in accordance with Uniform Guidance requirements. Additionally, there is a lack of oversight controls to verify completion and documentation of the risk assessment process. Possible Effect: Without performing and documenting subrecipient risk assessments, the Organization runs the risk that monitoring procedures are not appropriately tailored to the level of risk. This increases the likelihood that noncompliance with Federal requirements may occur and remain undetected. Questioned Costs: None. Perspective: Statistical sampling was not used, however, sampling methodology followed AICPA guidelines. Repeat Finding: This is not a repeat finding. Recommendation: We recommend the Organization develop and implement formal policies and procedures to ensure that risk assessments are performed for all subrecipients at the time of subaward and updated as necessary. The process should include documented consideration of required risk factors in accordance with 2 CFR §200.332(b) and should be used to determine the appropriate level and frequency of monitoring activities. Management’s Response (unaudited): See Corrective Action Plan.
Criteria 2 CFR § 200.332 requires a pass-through entity to evaluate each subrecipient’s risk of noncompliance and monitor the subrecipient’s activities as necessary to ensure that the subaward is used for authorized purposes, complies with applicable requirements, and achieves performance goals. Monitoring includes reviewing financial and performance reports and following up on identified deficiencies. Condition The Town awarded $3,575,000 of EPA grant funds to the Suffolk County Water Authority (the “Subrecipient”) as a subrecipient. Although the Town verified that the Subrecipient obtained required single audits for 2024 and 2025, the Town did not have adequate procedures to review the Subrecipient’s expenditures for allowability before including them in applications for payment. In addition, the Town did not have procedures in place to monitor the Subrecipient’s procurement process relating to this program for compliance with the grant agreement. The Town’s executed subrecipient agreement with the Subrecipient did not include all compliance requirements as identified by the grant agreement. Accordingly, the Town’s monitoring did not provide reasonable assurance that subaward funds were used for authorized purposes and in accordance with the federal award. Cause While the Town did assess the Subrecipient’s risk of non-compliance, the Town did not implement procedures to compare the subrecipient agreement to the grant agreement prior to issuance, and did not implement procedures to effectively monitor the Subrecipient for this program. Effect Without adequate communication of compliance requirements to the Subrecipient, and monitoring of the Subrecipient’s procurement and expenditures, there is an increased risk that the Town will not be in compliance with the terms of the grant agreement. Questioned Costs Unknown Recommendation We recommend that the Town ensure subrecipient agreements include all grant terms identified in the grant agreement and implement procedures to monitor the Subrecipient’s expenditures for allowability and compliance with procurement requirements prior to submission of requests for payment to the EPA. Views of Responsible Officials Management agrees with this finding. Community Development will review existing and future subrecipient agreements and update as necessary to ensure that all grant terms are included in the agreements. In addition, Community Development will establish and implement procedures to monitor the subrecipient’s expenditures for allowability and compliance with procurement requirements prior to submission of requests for payment to the EPA for all existing and future subrecipient agreements.
2025-001 Improve Controls and Documentation Over Subrecipient Monitoring Federal Program Information Federal Agency: Department of Health and Human Services Award Name(s): Child Care and Development Block Grant Assistance Listing Number(s): 93.575 Award Year: 2022 Compliance Requirement: Subrecipient Monitoring Federal Agency: Department of Health and Human Services Award Name(s): Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number(s): 93.391 Award Year: 2022 Compliance Requirement: Subrecipient Monitoring Type of Finding Compliance Internal Control over Compliance – Significant Deficiency Criteria or Specific Requirement OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (UG) requires that a pass-through entity must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information as required in 2 CFR 200.332(b). Condition and Context During our fiscal year 2024 audit, we tested a sample of one subrecipient under the Child Care and Development Block Grant in order to determine if the subrecipient agreements contained all required elements per 2 CFR 200.332(b) and ensure sufficient subrecipient monitoring procedures were performed. As a result of our testing, it was identified that the agreement tested did not contain the subrecipient’s unique entity identifier, federal award identification number, federal award date, assistance listing title, assistance listing number, dollar amount available under each federal award and assistance listing number at the time of disbursement, and approved indirect cost rate. While assistance listing number 93.391 was not tested as a major federal program in 2025, and subrecipient monitoring is no longer applicable to 93.575 based on the 2025 Compliance Supplement, we have carried forward the finding from the prior year and applied it to this program as it has not yet been resolved. Cause The Organization did not have adequate controls in place to ensure all required elements were included in subrecipient agreements. Effect or Potential Effect The Organization did not comply with the requirements of the Uniform Guidance regarding communication to subrecipients all the specified elements in 2 CFR 200.332(b). No questioned costs are reported as this requirement is administrative in nature. Recommendation The Organization should address the weakness in internal control noted above and update its subrecipient agreements, policies, and procedures to ensure that all required elements are present to comply with the Uniform Guidance. Views of Responsible Official Management’s corrective action plan is included at the end of this report after the Schedule of Prior Year Findings.
2025-002 Subrecipient Monitoring – Required Award Information Program Information Federal Agency U.S. Department of Health and Human Services, Passed through the Washington State Department of Health Assistance Listing Numbers 93.323 Epidemiology and Laboratory Capacity of Infectious Diseases (ELC) Award Numbers NU50CK000515 Criteria Under 2 CFR 200.332(b), a pass-through entity is required to ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required federal award identification information. Required information includes, among other information, the Federal awarding agency, Federal Award Identification Number (FAIN), and Assistance Listing Number (ALN). [X] Compliance Finding [X ] Significant Deficiency [ ] Material Weakness Condition The Organization was not able to demonstrate that the Federal awarding agency, Federal award identification number (FAIN), and assistance listing number (ALN) were communicated to subrecipients. Cause Required communications were reportedly sent by the former Executive Director via email; however, supporting documentation was not retained or available for audit. Effect Failure to properly identify subawards and communicate required federal award information may result in subrecipients not being fully aware of the federal source of funding, applicable compliance requirements, reporting obligations, indirect cost rate requirements, audit requirements, access-to-records provisions, and closeout responsibilities. This condition increases the risk that subrecipients may not comply with federal statutes, regulations, and award terms and conditions, and that the Organization may not effectively fulfill its pass-through entity responsibilities for subrecipient monitoring. Questioned Costs None noted. Context We selected four subrecipient agreements out of a population of seven. All four agreements tested were missing the required information noted above. Recommendation The Organization should implement procedures to ensure all required subrecipient award information is communicated in accordance with federal requirements as part of the subrecipient agreements. Views of responsible officials and planned corrective action All required funding source information will be included in partner contracts moving forward. Corrective action plan is 2 fold: 1. OCH will email all 2026 subawardees the required funding source information and save this documentation within the appropriate contract folder. 2. OCH will update it’s contract templates to include funding source information and all future contracts will include this within the contract.
Reportable Finding Considered a Significant Deficiency and Noncompliance Finding – Subrecipient Monitoring Compliance Agency: U.S. Department of State, Bureau of Population, Refugees, and Migration (PRM) Program: U.S. Refugee Admissions Program ALN# 19.510 Grant Number: SPRMCO25CA0026 and SPRMCO25CA0028 Program Year: 2025 Criteria: 2 CFR §200.332 requires pass-through entities to establish and implement procedures to monitor subrecipients and ensure compliance with federal statutes, regulations, and the terms and conditions of federal awards. Effective internal controls should include documented policies and procedures governing the subrecipient monitoring process. Condition: Community Sponsorship Hub (CSH) did not have formally documented and approved subrecipient monitoring policies and procedures in place during FY2025. Although management performed various monitoring activities, including execution of subaward agreements, review of reimbursement requests, financial and programmatic reporting reviews, and communication with subrecipients, these procedures were not formally documented in a written policy until 2026. Cause: Management had established operational subrecipient monitoring practices but had not formally documented these practices in approved policies and procedures during the period under audit. As a result, monitoring activities were performed based on institutional knowledge rather than a formally established control framework. Effect: The absence of formal written policies and procedures increases the risk that subrecipient monitoring activities may be applied inconsistently, incompletely, or not performed in accordance with Uniform Guidance requirements. This could result in noncompliance by subrecipients not being identified and addressed in a timely manner. Questioned costs: None Perspective: Statistical sampling was not used; however, a nonstatistical sampling approach was applied in accordance with AICPA guidance. The deficiency impacts the design of internal controls over CSH’s subrecipient monitoring process and therefore represents a systemic issue rather than an isolated occurrence. Testing of selected subawards indicated that monitoring activities were generally performed and documented; however, the lack of a formal written policy existed throughout FY2025 and affected all federal programs with subrecipient activity. Repeat finding: This is not a repeat finding. Recommendation: We recommend that management establish, approve, and maintain comprehensive written subrecipient monitoring policies and procedures that comply with 2 CFR §200.332. The policy should clearly define responsibilities, risk assessment procedures, monitoring activities, documentation requirements, follow-up procedures, and compliance review requirements for all subrecipients. Management’s response (unaudited): See Corrective Action Plan
Reporting – Special Reports for FFATA and Subrecipient Monitoring Assistance Listing Number 14.251 – Economic Development Initiative, Community Project Funding, and Miscellaneous Grants U.S. Department of Housing and Urban Development (HUD) Federal Award Identification Number(s): B-22-CP-CO-0165 Award Year – 2022 Criteria or specific requirement(s): In accordance with the Federal Funding Accountability and Transparency Act (FFATA) and 2 CFR Part 170, recipients are required to report applicable first-tier subawards of $30,000 or more, including required data elements, in SAM.gov by the end of the month following the month in which the subaward obligation was made. Furthermore, pursuant to 2 CFR § 200.332(a), pass-through entities are required to clearly identify federal award information and communicate all applicable federal requirements, terms and conditions, and compliance requirements to subrecipients at the time of the subaward. Required information includes, among other items, the Assistance Listing number and name, federal award identification information, indirect cost rate and any additional requirements imposed by the pass-through entity so that subrecipients can properly administer the federal award and comply with applicable federal requirements. Condition: During testing of FFATA reporting requirements, we noted that the City had one applicable first-tier subrecipient; however, the City did not report the subaward information in SAM.gov. Additionally during testing of subrecipient monitoring, we noted the City did not communicate required federal award information or increase in funding to its sole subrecipient as required by 2 CFR § 200.332(a). Cause: The City experienced a delay in receiving the federal award and initially funded the subaward with nonfederal resources. After the federal award was received and the related expenditures were identified as federally funded, the City did not have a process to update the subaward, communicate the federal award information and funding increase to the subrecipient, or evaluate FFATA reporting requirements. As a result, the required subaward information was not reported in SAM.gov or communicated to the subrecipient. Effect or potential effect: Failure to report the applicable first-tier subaward in accordance with FFATA requirements resulted in noncompliance with federal reporting requirements and reduced transparency over the use of federal funds by preventing complete and accurate subaward information from being available through federal transparency reporting systems. In addition, failure to communicate required federal award information to the subrecipient increases the risk that the subrecipient would be unaware of applicable federal requirements and unable to properly administer the award in accordance with federal regulations and the terms and conditions of the subaward. Questioned costs: None Context: The City had one subrecipient during the audit period. The following testing was performed related to FFATA reporting: Transactions Tested -1 Subaward not reported -1 Report not timely -1 Subaward amount incorrect - Unable to test due to subaward no tbeing reported Subaward missing key elements -Unable to test due to subaward not being reported Dollar Amount of Tested Transactions - $1,045,014 Subaward not reported - $1,045,014 Report not timely - $ 1,045,014 Subaward amount incorrect -Unable to test due to subaward not being reported Subaward missing key elements - Unable to test due to subaward not being reported Additionally, we performed subrecipient monitoring testing over the sole subrecipient and identified the compliance exception described above. Identification as a repeat finding, if applicable: N/A Recommendation: We recommend the City submit any outstanding FFATA reporting information and formally notify the subrecipient of the increase in funding, applicable federal requirements, and terms and conditions of the award. We also recommend the City implement procedures to identify and assess compliance requirements when funding sources and award amounts change, including procedures to ensure required reporting, documentation, and subrecipient communications are updated timely and accurately. Views of responsible officials and planned corrective actions: Agree. See separate corrective action plan.
Criteria: 2 CFR 200.332 requires a pass-through entity to identify required subaward information, evaluate each subrecipient’s fraud risk and risk of noncompliance, monitor subrecipient activities, verify required audits under Subpart F, and consider audit or monitoring results for corrective action, adjustments, or enforcement. Condition: The entity did not have formal policies and procedures for subrecipient monitoring, incorrectly classified the subrecipients as vendors, did not perform or document formal subrecipient risk assessments, did not obtain or request subrecipient audit reports, and approved subrecipient agreements that included incorrect Assistance Listing Numbers (ALN). The entity did review and approve sampled reimbursement requests for allowability and performed monitoring of programmatic performance and progress; however, those procedures did not address all required subrecipient monitoring elements under 2 CFR 200.332. (See also Finding 2025-001 regarding the SEFA reporting deficiency arising from the same misclassification.) Cause: The entity had not established formal subrecipient monitoring policies and procedures sufficient to ensure required monitoring activities were consistently performed and documented. Effect: The entity may not identify subrecipient noncompliance, audit findings, corrective action needs, or incorrect federal award information on a timely basis. Incorrect ALNs in subrecipient agreements increase the risk that subrecipients report the award under the wrong federal program. Recommendation: The entity should develop, document, and implement internal control procedures over federal award agreements and subrecipient monitoring to ensure compliance with 2 CFR 200.331 and 2 CFR 200.332. The procedures should require, at a minimum, documented subrecipient-versus-contractor determinations at the onset of each agreement, documented subrecipient risk assessments, accurate identification of required subaward information including the ALN, review of financial and performance reports, verification of required Subpart F audits, review and follow-up of audit findings or other significant developments, and documentation of monitoring procedures performed. Management should also establish a documented review control over subrecipient agreements to ensure required federal award information is accurate before execution and retain evidence of review, approval, monitoring conclusions, and any required corrective action. Management’s Response and Corrective Action Plan is found on page 29-31.
Finding No. 2025-001 U.S. Department of Commerce National Oceanic and Atmospheric Administration Assistance Listing No. (ALN) 11.999 – Abandoned and Derelict Vessels (ADV) - Leveraging Strategic Partnerships for Removal, Disposal, Prevention and Education Type of finding – Material Weakness in Internal Controls and Non-Compliance over Subrecipient Monitoring Repeat Finding – No Criteria The BoatU.S. Foundation (BoatU.S.) team coordinates the subrecipient monitoring process for the ADVs - Leveraging Strategic Partnerships for Removal, Disposal, Prevention and Education. ADVs program is funded by the US Department of Commerce, passed through by National Oceanic and Atmospheric Administration (NOAA). Per 2 CFR 200.303(a), BoatU.S. must establish and maintain effective internal controls over Federal awards that provides reasonable assurance that they are managing Federal awards in compliance with Federal statues, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs. Per 2 CFR Section 200.332, all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent award modification. Required information includes: (1) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number (ALN) at the time of disbursement, and, (2) A non-Federal entity that expends $1 million or more in Federal awards during the non-Federal entity's fiscal year must have a single audit conducted in accordance with § 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) or (d) of this section. Also, per 2 CFR Section 200.332, the pass-through entity is responsible for monitoring the activities of the subrecipient, as necessary, to ensure that the subaward is used for authorized purposes, in compliance with the Federal statutes, regulations, and the terms and conditions of the subaward; and that the subaward performance goals are achieved. Condition BoatU.S. Foundation did not incorporate the need for a single audit for subrecipients that expend more than $1 million of federal funding in a given fiscal year into the fiscal year 2025 contracts and the contracts and disbursements currently do not indicate ALN number at the time of each disbursement. Regarding subrecipient monitoring, no substantial documentation of onsite monitoring and validation of subrecipient costs being used for authorized purposes was performed. BoatU.S. Foundation Schedule of Findings and Questioned Costs (continued) Year Ended December 31, 2025 Cause BoatU.S.’s internal controls relating to subrecipient monitoring were not effective to properly monitor, obtain information and document the subrecipient monitoring process. Effect BoatU.S. was not in compliance with federal monitoring compliance regulations due to having insufficient documentation. Questioned Costs Unknown Recommendation: BoatU.S. should ensure that all requirements are incorporated into subrecipient contracts and disbursement information. BoatU.S. should also strengthen documentation of onsite and all monitoring procedures performed. Finally, BoatU.S. should implement stronger controls to ensure timely receipt of biannual subrecipient expense reports. Views of Responsible Officials: Management concurs with the audit finding. Corrective Action Plan: The BoatU.S. ADVs contract will be amended for fiscal year 2026 contracts to include the ALN, and the need for a Single Audit for subrecipients that expend over $1,000,000 in federal funding in their given fiscal year. BoatU.S. will implement stricter deadlines for subrecipients to submit their biannual reports in 2026. Progress monitoring will be done throughout the year and documented by BoatU.S. personnel. This should also include project cost documentation of the subrecipient is used for authorized purposes. These reports may need to include photos of the tasks completed, if necessary. BoatU.S. plans to only reimburse for progress costs as incurred by the subrecipient. Implementation date: September 2026 Responsible Person: Alison Trimble, Director, Operations
Finding 2025-003 Subrecipients Information on the Federal Programs: Federal Agency(ies): Department of Health and Human Services Federal Program(s): Strengthening Public Health Systems and Services through National Partnerships to Improve and Protect the Nation’s Health Assistance Listing Number(s): 93.421 Pass-through Entity (if Applicable): None for the awards impacted by the finding.Award Identification Number and Year: 6 NU38PW0000-01-02, 5 NU38PW000033-02-01. Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): Recipients that pass Federal funds through to subrecipients must: Make subawards containing all information required by 2 CFR 200.332(a); Evaluate each subrecipient's risk of noncompliance to determine the appropriate level of monitoring under 2 CFR 200.332(b); Distinguish subrecipients from contractors in accordance with 2 CFR 200.331 and apply the appropriate requirements; Maintain adequate policies, procedures, and accounting records to identify and track subaward expenditures separately from contractor expenditures; and Not exceed fixed amount subawards in excess of the limitations established in 2 CFR 200.333. Condition: BCHC had established certain subrecipient oversight practices, including regular meetings with subrecipients and review of invoices prior to reimbursement. However, the Organization's subrecipient monitoring policies, procedures, and documentation did not fully meet the requirements of Uniform Guidance. Specifically: BCHC issued fixed amount subawards that exceeded the maximum amount permitted under 2 CFR 200.333. BCHC did not perform and document risk assessments of subrecipients prior to making awards. Subaward agreements did not include all information required by 2 CFR 200.332(a). BCHC did not consistently distinguish between subrecipients and contractors, as evidenced by the use of contractor procurement documentation (e.g., sole-source justifications) for subrecipient relationships and the commingling of subaward and consulting expenses within the general ledger. While BCHC had established certain monitoring activities, it had not formalized written policies and procedures governing subrecipient determinations and monitoring responsibilities. Cause: BCHC had established certain practices for administering pass-through awards; however, formal written policies and procedures were not in place to comprehensively address subrecipient determinations, risk assessments, subaward issuance, monitoring, and accounting for subrecipient expenditures. In addition, available guidance and controls could be strengthened to better distinguish subrecipients from contractors, ensure all required information is included in subaward agreements, perform and document risk assessments, monitor compliance with fixed-amount subaward limitations, and separately track subaward expenditures. Effect or Potential Effect: These issues increase the risk that Federal funds may not be administered in accordance with Uniform Guidance requirements and that noncompliance by subrecipients may not be identified or addressed in a timely manner. Additionally, BCHC may be unable to demonstrate effective oversight of subawards or provide complete and accurate information regarding subrecipient expenditures.Questioned Costs: Undeterminable. BCHC maintained ongoing communication with and oversight of the subrecipient to monitor progress and completion of the funded activities. In addition, the subrecipient identified and reported the Federal award in its Uniform Guidance audit and no findings related to the award were reported. As a result, while the control deficiencies constitute noncompliance with Uniform Guidance requirements and increase the risk of undetected noncompliance, the auditor was not aware of any specific expenditures that were unallowable, unsupported, or improperly charged to the Federal program. Accordingly, questioned costs, if any, are undeterminable. Context: There was only one subrecipient during 2025 (with 3 separate awards). Identification as a Repeat Finding, if Applicable: This is not a repeat finding. Recommendation: We recommend that BCHC develop, document, and implement formal policies and procedures for the administration and monitoring of subawards in accordance with Uniform Guidance requirements. At a minimum, these procedures should require: (1) a documented assessment of subrecipient risk prior to issuing a subaward and periodic reassessment as appropriate; (2) inclusion of all required Federal award information in subaward agreements; (3) clear criteria and documentation supporting the determination of whether an entity is a subrecipient or contractor; (4) monitoring procedures commensurate with the assessed level of risk; (5) compliance with limitations applicable to fixed amount subawards; and (6) accounting procedures that separately identify and track subrecipient expenditures within the general ledger. In addition, BCHC should provide training to personnel responsible for Federal award administration to ensure Uniform Guidance requirements related to subrecipient monitoring are consistently applied and documented.
Federal Agency: USDA Cooperative Fire Assistance Federal Program Name: State and Private Forestry Cooperative F Assistance Listing Number: 10.698 Federal Award Identification Year: 2025 Pass-Through Agency: N/A Award Period: 1/1/25-12/31/25 Compliance Requirement Affected: [M] Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR §200.332 requires pass-through entities to monitor the activities of subrecipients as necessary to provide reasonable assurance that the subrecipient administers federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity should maintain documentation demonstrating performance of required monitoring procedures. Condition: During testing of subrecipient monitoring controls, auditors selected six transactions for review and noted two instances in which management was unable to provide documentation evidencing completion of required subrecipient monitoring procedures. According to management, certain monitoring documentation and related communications could not be located due to turnover of key personnel. As a result, the operating effectiveness of controls over subrecipient monitoring could not be demonstrated for the selected transactions. Context: During testing of six subrecipient monitoring selections, two transactions totaling $56,728 were identified for which CFSC could not provide documentation demonstrating completion of required subrecipient monitoring procedures. Management indicated the documentation could not be located due to turnover of key personnel. The exceptions represented approximately 33% of the items tested. Effect: Without retained documentation demonstrating the performance of subrecipient monitoring activities,the Organization cannot demonstrate compliance with federal requirements designed to ensure federal funds are used in accordance with applicable laws, regulations, and award terms. This increases the risk that noncompliance by subrecipients may not be detected timely. Cause: Management indicated that documentation supporting completion of monitoring activities and related communications could not be located due to turnover of personnel responsible for administering and documenting subrecipient monitoring procedures. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend management strengthen procedures for retaining subrecipient monitoring documentation and establish controls to ensure monitoring activities are consistently documented and maintained, including during personnel transitions. Management’s Views: See separate corrective action plan.
Assistance Listing Number: 93.193 Name of Federal Program: Urban Indian Health Services; COVID-19 Urban Indian Health Services Name of Federal Agency: Department of Health and Human Services Award Period: January 1, 2025 – December 31, 2025 Criteria or Specific Requirement: Per 2 CFR Part 200, non-federal entities receiving federal awards must establish and maintain written policies and procedures addressing areas including, but not limited to: procurement (§200.317–§200.327); travel costs (§200.475); methods for avoiding duplication of costs (§200.403); subrecipient monitoring (§200.332); cash management and allowable costs (§200.302, §200.305). Condition: The organization has not implemented all policies and procedures required under the Uniform Guidance. Specifically, certain written policies and procedures required by 2 CFR Part 200, such as cash management, allowability of costs, equipment management, conflict of interest, procurement, travel, compensation, and fringe benefits, were either incomplete, not formally documented, or not in place during the audit period. Cause: Due to timing constraints and a small staff size, the Council has not detailed its policies to conform with the requirements of the Uniform Guidance. Effect or Potential Effect: Without documented and implemented policies and procedures, the organization increases the risk of noncompliance with federal regulations, inconsistent application of requirements, unallowable costs being charged to federal awards, and potential questioned costs or sanctions from funding agencies. Repeat Finding: Yes, this is a repeat of Finding 2024-003. Recommendation: Management should develop, formally adopt, and implement all required Uniform Guidance policies and procedures. Policies should be documented, communicated to relevant staff, and periodically reviewed to ensure ongoing compliance. Views of Responsible Officials: Management agrees with the finding and revise its policies and procedures to meet the criteria of the Uniform Guidance.
2025-003 – Significant Deficiency in Internal Control over Subrecipient Monitoring and Noncompliance Identification of federal programs: United States Department of Commerce (DOC) ALN 11.463 - Habitat Conservation Grant Award NA25NMFX463C0022 Criteria: Part 3 Compliance Supplement Under 2 CFR §200.332, pass-through entities are responsible for monitoring the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes, comply with applicable federal statutes, regulations, and the terms and conditions of the subaward, and that performance goals are achieved. Monitoring activities may include reviewing financial and performance reports, performing follow-up on identified deficiencies, and issuing management decisions when applicable. Additionally, pass-through entities are required to verify whether subrecipients that expend $750,000 or more in federal awards obtain the required Single Audit, review audit reports for findings related to the federal program, issue management decisions on applicable findings, and ensure timely corrective action. Condition: The Organization issued one subaward under ALN 11.463 during the fiscal year. The Organization performed a risk assessment of the subrecipient and maintained ongoing communication regarding project activities. However, the Organization did not establish or perform sufficient monitoring procedures to fully demonstrate compliance with Uniform Guidance subrecipient monitoring requirements. Specifically: • The Organization did not require or obtain formal financial reports sufficient to monitor the subrecipient's use of federal funds after subaward funds were advanced. • The Organization did not obtain formal performance reports documenting progress toward program objectives. • The Organization did not document procedures to determine whether the subrecipient was subject to Single Audit requirements. • The Organization did not review applicable Single Audit reports. • The Organization did not document follow-up procedures or management decisions related to audit findings affecting the subrecipient, if applicable. Cause: At the time the subaward was issued and monitored during fiscal year 2025, the Organization had not established procedures addressing all Uniform Guidance subrecipient monitoring requirements. Management adopted revised subrecipient monitoring policies in December 2025; however, the monitoring procedures required by those policies were not fully applied to the subaward issued during the fiscal year. Effect or potential effect: Although the Organization maintained oversight of the subrecipient through risk assessment procedures, project deliverable reviews, ongoing communications, and project management activities, the Organization did not perform and document all monitoring procedures required under 2 CFR 200.332. As a result, the Organization cannot fully demonstrate compliance with all pass-through entity monitoring requirements, increasing the risk that subrecipient compliance issues may not be identified, evaluated, and resolved in a timely manner. Questioned Costs: None. Context: The Organization issued one subaward under ALN 11.463 during fiscal year 2025. Audit procedures identified that required monitoring procedures were not performed or documented for the subaward issued during fiscal year 2025. Although the Organization adopted revised subrecipient monitoring policies in December 2025, the procedures were not applied retrospectively to the subaward under audit. Identification of Repeat Finding: N/A Recommendations: We recommend that management continue implementation of its revised subrecipient monitoring policies and ensure that monitoring procedures are performed and documented for all current and future subawards and well as ensuring those monitoring requirements are communicated to the subrecipient. Monitoring activities should include review of financial and performance reporting, verification of Single Audit requirements, review of applicable audit reports, and documented follow-up of audit findings when required. Views of Responsible Officials: Management agrees with this finding. See Corrective Action Plan.
SCHEDULE OF FEDERAL AWARD FINDINGS AND QUESTIONED COSTS Spokane Conservation District January 1, 2025 through December 31, 2025 2025-001 The District did not have adequate internal controls for ensuring compliance with federal subrecipient monitoring and suspension and debarment requirements, and it did not comply with federal suspension and debarment requirements. Assistance Listing Number and Title: 10.727 Inflation Reduction Act Urban & Community Forestry Program Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 24-DG-11062765-154 Pass-through Entity Name: N/A Pass-through Award/Contract Number: N/A Known Questioned Cost Amount: $0 Prior Year Audit Finding: Yes, Finding 2024-001 Background During fiscal year 2025, the District spent $774,900 in federal funds from the Inflation Reduction Act Urban & Community Forestry Program. The objective of this program is to plan for, establish, manage and protect trees, forests, green spaces and related natural resources in and near cities and towns. Of this amount, the District passed through $260,472 to two subrecipients. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Subrecipient Monitoring When the District passes on federal funds to subrecipients, federal regulations require it to monitor subrecipient activities. This includes ensuring the subrecipient receives a federal single audit when required, following up and ensuring the subrecipient takes timely and appropriate action on all audit findings, and issuing a management decision as required. The District must maintain documentation showing it performed this verification. Suspension and Debarment Federal requirements prohibit recipients from contracting with or purchasing from parties suspended or debarred from doing business with the federal government. Whenever the District enters into contracts or purchases goods and services that it expects to equal or exceed $25,000, paid all or in part with federal funds, it must verify the contractors are not suspended, debarred or otherwise excluded from participating in federal programs. The District may verify this by obtaining a written certification from the contractor, adding a clause or condition into the contract that states the contractor is not suspended or debarred, or checking for exclusion records in the U.S. General Services Administration’s System for Award Management at SAM.gov. The District must verify this before entering into the contract, and must maintain documentation demonstrating compliance with this federal requirement. Description of Condition Subrecipient Monitoring The District did not have effective internal controls to document and demonstrate it verified the two subrecipients tested received a single audit and that it followed up with the results of that audit, when necessary, as federal regulations require. We consider this internal control deficiency to be a significant deficiency. Suspension and Debarment Our audit found the District did not have adequate internal controls to verify the one contractor we tested that it paid more than $25,000 in federal funds was not suspended or debarred from participating in federal programs before purchasing from them. We consider this deficiency in internal controls to be a material weakness that led to material noncompliance. Cause of Condition Subrecipient Monitoring Although District staff said they were aware of the requirement and reviewed the Federal Audit Clearinghouse site, they could not locate documentation showing they verified whether the subrecipients received a single audit when required. Suspension and Debarment Although District staff said they were aware of the requirements, they could not locate documentation to show they verified the contractor’s suspension and debarment status. Additionally, although the District subsequently verified the contractor’s status when it received the prior audit finding for the 2024 audit, it was after purchasing from the contractor. Effect of Condition Subrecipient Monitoring The District did not retain documentation showing it verified whether the subrecipients received a single audit when required. Without documentation, the District cannot demonstrate it is properly monitoring its subrecipients and that the subrecipients complied with federal program requirements and received a single audit when required. Suspension and Debarment The District did not obtain a written certification from the contractor, insert a clause into the contract or check for exclusion records at SAM.gov to verify the contractor it paid $185,998 with federal funds was not suspended or debarred before contracting. Without adequate internal controls, the District increases its risk of awarding federal funds to contractors that are excluded from participating in federal programs. Any payments the District made to an ineligible party would be unallowable, and the awarding agency could potentially recover them. The District subsequently verified the contractor was not suspended or debarred. Therefore, we are not questioning costs. Recommendation Subrecipient Monitoring We recommend the District establish internal controls to retain documentation showing it verified that subrecipients received a single audit when required. Suspension and Debarment We recommend the District strengthen its internal controls to verify all contractors it pays $25,000 or more, all or in part with federal funds, are not suspended or debarred from participating in federal programs and maintain documentation demonstrating compliance with this requirement. District’s Response The District concurs with Finding 2025-001. The District acknowledges that although staff performed searches of the Federal Audit Clearinghouse for both subrecipients and were aware of the suspension and debarment requirements; however, the District did not retain documentation demonstrating these verifications, as required by 2 CFR 200.303, 2 CFR 200.332, and 2 CFR 200.214. Subrecipient Monitoring District staff were aware of the single audit requirements and reviewed the Federal Audit Clearinghouse for both subrecipients during the audit period; however, documentation of those verifications was not retained. The District has since followed up in writing with both subrecipients and obtained written confirmation that neither subrecipient exceeded $1,000,000 in federal expenditures during fiscal year 2025 and that neither expects to exceed the single audit threshold in fiscal year 2026. Accordingly, single audits were not required for either subrecipient. The written correspondence is retained in the subaward files. Going forward, all subrecipient monitoring activities — including Federal Audit Clearinghouse searches, single audit determinations, follow-up on audit findings, and management decisions — will be documented and retained in each subaward file at the time the verification is performed. Suspension and Debarment The District concurs that documentation was not retained for the suspension and debarment verification of the contractor paid $185,998 in federal funds. The contractor was subsequently verified as not suspended or debarred, and no further contracting activity occurred under the affected award. The District has implemented controls requiring verification of suspension and debarment status — through a SAM.gov exclusion check, a written certification from the contractor, or a contract clause — before entering into any contract or purchase expected to equal or exceed $25,000, paid in whole or in part with federal funds, consistent with 2 CFR 200.214 and 2 CFR Part 180. Documentation of each verification will be retained in the procurement file at the time of award. Corrective Action To provide sustained assurance and to address both components of this finding, the District is implementing a project management system with automated reminders and checklists covering the full life cycle of federal awards, subawards, and procurements. In addition, the district has updated its suspension and debarment policy and will formalize subrecipient monitoring documentation requirements. These updates will be incorporated into the District's annual contract and procurement training for all relevant staff. Completion is anticipated by December 31, 2026. Auditor’s Remarks We appreciate the District’s commitment to resolve this finding and thank the District for its cooperation and assistance during the audit. We will review corrective action taken during the next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303 Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for passthrough entities, establishes subrecipient monitoring and management requirements for pass-through entities. Title 2 CFR Part 180, OMB Guidelines to Agencies on Governmentwide Debarment and Suspension (Nonprocurement), establishes nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689.
Criteria or Specific Requirement Per 2 CFR § 200.332(b)(1) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the available information when it is obtained. Required information includes: (1) Federal award identification. (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated in the subaward; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; (xiii) Identification of whether the Federal award is for research and development; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with § 200.414) In addition, direct recipients passing funds to subrecipients are required to have subrecipient monitoring controls in accordance with CFR § 200-331. Under this CFR, internal controls should designed and operating effectively to provide reasonable assurance that the subrecipient used the subaward for authorized purposes in compliance with statutes, regulations, and terms and conditions of the subaward; referred to as subrecipient monitoring. Condition The County did not have an adequate process, or internal controls designed to ensure compliance with subaward agreements and monitoring procedures. Questioned Costs None. Context The County passed funding to one subrecipient and one subrecipient was selected for testing in fiscal year 2025. Based upon the subrecipient selected for testing, the subrecipient agreement was executed but did not include all required information under CFR § 200.332. In addition, the County does not have a formal process to monitor expenditures incurred by subrecipients. Reimbursement requests are submitted by subrecipients but supporting documentation was not consistently provided by subrecipient to enable the County to effectively monitor subrecipient expenditures. Cause The County’s subrecipient contracting process is not designed to include all information required under CFR § 200.332. The County has not implemented internal controls and formal policies and procedures over subrecipient monitoring. Effect Federal Funding lacking proper monitoring procedures could cause subrecipients to spend money on unallowable activities. Grant awards not containing required information won't allow subrecipients to be fully aware of grant requirements. Recommendation We recommend the County design subrecipient contracting internal controls to include all necessary information under CFR § 200.332. We recommend implementing an official policy and design internal controls that outlines monitoring procedures and documentation of these procedures when funding is passed through to subrecipients. Repeat Finding Yes, prior year finding 2024-002 Views of Responsible Officials There is no disagreement with the audit finding.
2025-002 Performance of Risk Assessments on Subrecipients Federal Organization U.S. Department of Health and Human Services Assistance Listing Number 93.566 Award Number 2312-52361 Criteria [X] Compliance Finding [X] Significant Deficiency [ ] Material Weakness Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Subpart D, § 200.332, states that pass-through entities must evaluate each subrecipient’s fraud risk and risk of noncompliance with the subaward to determine the appropriate level of subrecipient monitoring needed Condition During our testing of subrecipient monitoring, we noted that there was no formal process in place to perform risk assessments on subrecipients. Context This finding appears to be a systemic issue. Cause The Organization did not implement a process to ensure that subrecipients were considered to be low risk of noncompliance with the terms and conditionsof the subaward. Effect The Organization may have passed down funds to a subrecipient who is high risk for noncompliance. Questioned Costs None identified Recommendation We recommend management implement a system to ensure that risk assessments are performed on potential subrecipients before awarding subrecipient contracts. Views of responsible officials and planned corrective action: Community-Minded Enterprises (CME) agrees with the finding and has implemented a formal Subrecipient Risk Assessment and Monitoring Policy and related procedures to strengthen its subrecipient oversight process and ensure compliance with 2 CFR §200.332.
2025-001- Subaward Documentation and Subrecipient Monitoring. Significant deficiency in internal control over compliance and noncompliance with subrecipient monitoring requirements. Under 2 CFR 200.331 and 200.332, as applicable to the respective awards, a pass-through entity must distinguish subrecipient relationships from contractor relationships, clearly identify subawards, communicate required federal award information and applicable terms, evaluate subrecipient risk, and perform appropriate monitoring. Monitoring includes reviewing financial and performance reports and following up on identified issues. SI2’s monitoring procedures should be implemented and supported by records demonstrating the activities performed and resolution of identified concerns. SI2 performed substantive activities to administer and monitor its subawards during 2025 – subrecipient invoices were reviewed and processed through SI2’s award cost trackers, which allocate each invoice between the federal share and required cost sharing. However, documented risk assessments had not been prepared, certain monitoring activities were not documented in the subaward files, and one subaward agreement did not include required federal award information and provisions, as described below. • The Kearns & West SUDS arrangement was documented through a statement-of-work rider to a master services agreement structured as a contractor arrangement, although the substance of the relationship was that of a subaward. Review of the master agreement, rider, and incorporated documents identified the omission of required subaward information and provisions, including identification of the arrangement as a subaward, the federal award identification data required by 2 CFR 200.332, the indirect cost rate provision, flow-down of the applicable federal requirements, audit and compliance requirements appropriate to the subrecipient’s entity type, records-access provisions, and closeout terms. The arrangement provided for a federal share of $579,335 with required nonfederal cost sharing of $144,834; federal expenditures under the subaward during 2025 were approximately $265,215, included in the $393,169 passed through to subrecipients under the SUDS award reported on the SEFA. • In addition, documented risk assessments had not been prepared for the 12 first-tier subawards in the population; subrecipient-versus-contractor determinations were undocumented or contained responses inconsistent with the stated conclusion for two arrangements; and, although subrecipient invoices were reviewed in connection with processing and cost-share allocation, the other monitoring activities described in SI2’s Subrecipient Monitoring Plan were not documented in the subaward files during 2025. Following receipt of the risk-assessment template provided during the audit, management began completing documented risk assessments in 2026 and had completed assessments for five subrecipients as of the date of this report; these actions are corrective in nature and are reflected in the corrective action plan. This was SI2’s first year subject to a Single Audit under the Uniform Guidance, and its subrecipient monitoring processes were in the early stages of formalization. While personnel performed substantive administrative and monitoring activities, SI2’s Accounting Policies and Procedures Manual (adopted January 2025) did not yet specify the nature, frequency, documentation, and retention of monitoring procedures, and agreements were prepared using different formats without a standardized process for confirming required federal award provisions and documenting subrecipient-versus-contractor determinations. The omission of required subaward information and provisions reduced SI2’s assurance that applicable federal requirements were communicated to the affected subrecipient. The absence of documented risk assessments and of retained monitoring documentation reduced the evidence available to demonstrate compliance with subrecipient monitoring requirements and increased the risk that instances of subrecipient noncompliance would not be prevented, or detected and corrected, on a timely basis. Our testing did not identify questioned costs associated with this finding. The population consisted of 12 first-tier subawards under the three federal awards identified above. Federal expenditures provided to subrecipients under these awards during 2025 totaled approximately $856,305, determined on the accrual basis (amounts in this paragraph are presented rounded to the nearest dollar). This amount differs from the $1,040,123 of amounts provided to subrecipients reported on the SEFA because the SEFA total also includes approximately $183,818 passed through under federal programs outside the major program (Solar Ready Vets Network, approximately $181,690, and Aspire, approximately $2,128). We examined subaward documentation, classification determinations, and available risk-assessment and monitoring records for all 12 subawards; accordingly, the subaward-file review covered the entire population and did not involve sampling. This coverage does not represent examination of every underlying expenditure. Exceptions included one subaward with missing required agreement information or provisions, 12 subawards without documented risk assessments, two arrangements with missing or inconsistent classification determinations, and 12 subawards for which the monitoring activities described above were not documented in the subaward files as of the completion of fieldwork. There were no questioned costs identified. The procedures performed did not identify specific expenditures to question in connection with this finding. We recommend that SI2: amend the Kearns & West arrangement to clearly identify it as a subaward and include the missing federal award information and applicable provisions; establish a standard agreement-review checklist addressing required subaward information, applicable federal requirements, and award-specific terms; document and review subrecipient-versus-contractor determinations based on the substance of each arrangement; document subrecipient risk assessments when making subawards and update the assessments as circumstances change; assign responsibility for monitoring, establish the nature and frequency of monitoring based on assessed risk, and retain evidence of financial and performance report reviews and follow-up; and obtain and review support for required subrecipient cost sharing, including reports and certifications required by the applicable agreements.
For programs audited on or after October 1, 2025 2 CFR § 300.106 gives regulatory effect to the Department of Health and Human Services for 2 CFR § 200.332(g), which states a pass-through entity must verify that every subrecipient is audited as required by subpart F of this part. Subpart F details the Single Audit requirements for non-Federal entities expending more than $1,000,000 in Federal awards in a fiscal year. For programs audited on or before September 30, 2025 45 CFR § 75.352(f) states a pass-through entity must verify that every subrecipient is audited as required by subpart F of this part. Subpart F details the Single Audit requirements for non-Federal entities expending more than $1,000,000 in Federal awards in a fiscal year. The Subgrant Agreements between the Ohio Department of Job and Family Services (ODJFS) and Franklin County Department of Job and Family Services (the County) (Subgrantee) and between the County and US Together (Subrecipient) for the Refugee Support Services (RSS) program, state the Subgrantee will ensure that subrecipients expending $1,000,000 or more in Federal awards during the subrecipient’s fiscal year have met the audit requirements of this Agreement for that fiscal year. The County did not have the proper internal controls in place to help ensure that all subrecipients of the AL # 93.566 program were audited as required by subpart F. We noted 1 out of 4 (25%) of the AL # 93.566 program subrecipients did not receive a Single Audit for fiscal year 2025 and have not had a Single Audit since 2018. Failure to ensure that program subrecipients receive Single Audits could result in subrecipients’ noncompliance, questioned costs going undetected, and additional risks for the County as the passthrough entity. The County should establish internal control procedures to help ensure all subrecipients are audited according to subpart F, and that management review the subrecipients' Single Audit reports for findings or results that could impact the operations and decision-making of the County. Officials’ Response: Refer to corrective action plan.
The Revenue Support Services (RSS) grant agreement between the Ohio Department of Job and Family Services (ODJFS) and the Franklin County Department of Job and Family Services (the County) states in Article I, Subgrant Activities, that copies of the signed Acknowledgement of Rights and Responsibilities form must be maintained in participant profiles. The form must be acknowledged by the participant, the caseworker, and the interpreter when the form was not translated into the participant's primary language. Additionally, Article I requires the participant's self-sufficiency contract to be reviewed every six months and a follow-up assessment of the participant's progress toward established goals to be completed and documented. Furthermore, Appendix B of the Franklin County Department of Job and Family Services Purchase of Service Subaward Agreements (the subaward agreement) require employment counseling, employer collaboration, and employment tracking every six and twelve months. For programs audited on or after October 1, 2025 2 CFR § 300.106 gives regulatory effect to the Department of Health and Human Services for 2 CFR § 200.332(e), which states, in part, that all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals and objectives are achieved. For programs audited on or before September 30, 2025 45 CFR § 75.352(d) states in part that all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. The County did not have adequate internal controls in place to ensure its subrecipients complied with the requirements of the RSS grant and subaward agreements and did not adequately monitor subrecipient compliance with these requirements. During our testing of 60 participant packets maintained by the County's subrecipients, we noted the following: • Nine (9) of 60 (15%) participant packets tested did not contain the participant's signature on the RSS Acknowledgement of Rights and Responsibilities form, as required by Article I of the RSS grant agreement. • Five (5) of 60 (8%) participant packets tested did not contain documentation that the required six-month and/or twelve-month follow-up assessments were completed after the participant's initial enrollment, as required by Article I of the RSS grant agreement and Appendix B of the subaward agreement. The County's failure to adequately monitor its subrecipients contributed to these instances of noncompliance not being identified and corrected in a timely manner. Failure to obtain and maintain required participant acknowledgements increase the risk that participants may not fully understand program requirements, their rights and responsibilities, or the consequences of noncompliance. Failure to complete and document required follow-up assessments increases the risk that participant progress toward established self-sufficiency goals is not adequately monitored. Additionally, inadequate subrecipient monitoring increases the risk that noncompliance with federal requirements and the terms and conditions of the RSS grant agreement may occur and remain undetected, which could result in questioned costs, repayment of grant funds, or other corrective action by the grantor. We recommend the County establish and implement procedures to adequately monitor its RSS subrecipients for compliance with applicable federal requirements and the terms and conditions of the RSS grant and subaward agreements. Monitoring procedures should include a review of participant files to ensure required acknowledgements are obtained and maintained and required follow-up assessments are completed and documented. The County should document the monitoring performed, communicate identified deficiencies to its subrecipients, and follow up to ensure corrective action is taken in a timely manner. Officials’ Response: Refer to corrective action plan.
Assistance Listing Number: 93.193 Name of Federal Program: Urban Indian Health Services; COVID-19 Urban Indian Health Services Name of Federal Agency: Department of Health and Human Services Award Period: January 1, 2025 – December 31, 2025 Criteria or Specific Requirement: Per 2 CFR Part 200, non-federal entities receiving federal awards must establish and maintain written policies and procedures addressing areas including, but not limited to: procurement (§200.317–§200.327); travel costs (§200.475); methods for avoiding duplication of costs (§200.403); subrecipient monitoring (§200.332); cash management and allowable costs (§200.302, §200.305). Condition: The organization has not implemented all policies and procedures required under the Uniform Guidance. Specifically, certain written policies and procedures required by 2 CFR Part 200, such as cash management, allowability of costs, equipment management, conflict of interest, procurement, travel, compensation, and fringe benefits, were either incomplete, not formally documented, or not in place during the audit period. Cause: Due to timing constraints and a small staff size, the Council has not detailed its policies to conform with the requirements of the Uniform Guidance. Effect or Potential Effect: Without documented and implemented policies and procedures, the organization increases the risk of noncompliance with federal regulations, inconsistent application of requirements, unallowable costs being charged to federal awards, and potential questioned costs or sanctions from funding agencies. Repeat Finding: Yes, this is a repeat of Finding 2024-003. Recommendation: Management should develop, formally adopt, and implement all required Uniform Guidance policies and procedures. Policies should be documented, communicated to relevant staff, and periodically reviewed to ensure ongoing compliance. Views of Responsible Officials: Management agrees with the finding and revise its policies and procedures to meet the criteria of the Uniform Guidance.
Criteria or specific requirement: 2 CFR §180.300 and 2 CFR §200.332 require pass-through entities to ensure that subrecipients are not suspended or debarred from participating in federal programs. This may be accomplished by checking SAM.gov, obtaining a certification from the subrecipient, or including appropriate certifications in the subaward agreement. The pass-through entity should maintain documentation evidencing performance of the control. Condition: During testing of subrecipient monitoring controls for the JAG program, we noted the County did not maintain documentation demonstrating it verified the suspension and debarment status of subrecipients prior to issuing federal awards. Specifically, for the subrecipient selected for testing, management was unable to provide evidence that a SAM.gov search was performed or that a suspension and debarment certification was obtained and retained. Question costs: None Context: This finding applies to all three subrecipients that received pass-through funds during the fiscal year. Cause: County personnel were not retaining evidence that suspension and debarment verification procedures had been completed for subrecipients receiving federal awards. Effect: CLA recommends the County implement procedures requiring personnel to perform and retain documentation of suspension and debarment verification for all subrecipients prior to issuing subawards. Documentation may include SAM.gov search results, written certifications from subrecipients, or certifications incorporated into the subaward agreement. Repeat Finding: No Recommendation: CLA recommends the County implement procedures requiring personnel to perform and retain documentation of suspension and debarment verification for all subrecipients prior to issuing subawards. Documentation may include SAM.gov search results, written certifications from subrecipients, or certifications incorporated into the subaward agreement. Views of Responsible Officials: Management does not disagree with the finding.
2025-002 – Subrecipient Monitoring Federal program information: Funding Agency: U.S. Department of the Interior; Bureau of Indian Education Title: Indian Education Assistance to Schools Assistance Listing Number: 15.130 Award Period: December 9, 2024 – December 8, 2026 Criteria: Uniform Guidance regulations section 2 CFR 200.332(b) require a pass-through entity to ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification information listed at 2 CFR 200.332(b)(1). That information includes the subrecipient's unique entity identifier, the Assistance Listing Number and title, and the subaward budget period start and end date. Where any of that information is unavailable at the time of the subaward, the pass-through entity must provide the best available information and must provide the unavailable information when it is obtained. Condition: NFEAIE issued eight subawards totaling $6,635,000 during the year ended December 31, 2025. The Assistance Listing Number and title were not stated in any of the eight executed subaward agreements or their attachments. The subaward budget period was not stated in any of the eight agreements. The subrecipient's unique entity identifier was not stated in three agreements totaling $2,238,547. Context: Eight subawards tested, representing 100% of the subrecipient population and 96% of total federal expenditures for the year. Questioned Costs: None. Cause: The subaward template was drafted without comparing it to the information required by 2 CFR 200.332(b)(1). NFEAIE has no written procedure requiring executed subaward agreements to be reviewed against that information before execution. Effect: NFEAIE did not comply with 2 CFR 200.332(b)(1). A subrecipient that is not given the Assistance Listing Number may report the award incorrectly or omit it from its own schedule of expenditures of federal awards, which affects the subrecipient's major program determination and audit coverage, and may also affect subaward reporting under the Federal Funding Accountability and Transparency Act. Omission of the unique entity identifier removes the identifier used to match the subaward to the subrecipient's registration. Auditors' Recommendation: NFEAIE should amend each of the eight executed subaward agreements to add the Assistance Listing Number and title, the subaward budget period, and the unique entity identifier where it was omitted, and should provide the amended agreements to each subrecipient. NFEAIE should adopt a written subaward issuance procedure that includes a checklist of the information required by 2 CFR 200.332(b)(1), completed and retained in the subaward file before execution, and should update the subaward template before the second round of awards is issued. Management's Response: Management concurs with the condition described. Three of the federal award identification elements required by 2 CFR 200.332(b)(1) were omitted from the Round 1 subaward instruments. There are no questioned costs. The Round 1 instruments identified the subrecipient, the Federal Award Identification Number, the federal award date, the subaward period of performance, the total amount of the subaward, the federal award project description, the pass-through entity and its contact, the research and development determination, and the applicable indirect cost rate. They flowed down the Uniform Guidance cost principles and administrative requirements, records retention and audit access under 2 CFR 200.334 and 200.337, closeout obligations under 2 CFR 200.344 and 200.345, the nonprocurement suspension and debarment certification, and quarterly and annual reporting requirements. The omission was limited to the Assistance Listing Number and title, the subaward budget period, and, in three instruments, the unique entity identifier. Before making any subaward, NFEAIE evaluated forty applications through a competitive process, each scored independently by three reviewers, and conducted entity-level financial and compliance due diligence on applicants advancing to award consideration. Four applicants were declined or deferred on the basis of that review. NFEAIE has monitored the subawards throughout the period of performance. The Round 1 template was prepared in the organization’s first months of operation and was not checked against the data element list at 2 CFR 200.332(b)(1). NFEAIE corrected the template in September 2026. The corrected form was used for the subaward executed September 18, 2026 and carries the full element set, together with specific conditions imposed under 2 CFR 200.208 for subrecipients designated elevated risk. The remaining remediation is set out below.
Criteria: In accordance with 2 CFR Part 200.332, pass-through entities are required to evaluate each subrecipient’s fraud risk and risk of noncompliance and determine appropriate monitoring based on that risk. Pass-through entities are also responsible for reviewing applicable audit reports, following up on identified deficiencies or questioned costs, and verifying that subrecipients are eligible to participate in federal programs. Condition: The Organization had not established adequate procedures to monitor 4 of the 9 subrecipients tested receiving federal funds. Documented risk assessments were not performed, applicable audit reports were not consistently obtained and reviewed, and suspension and debarment status was not documented before subawards were issued. Cause: The Organization had not established formal policies governing subrecipient risk assessments, audit report review, suspension and debarment verification, or follow-up procedures. Responsibility for subrecipient monitoring also had not been formally assigned. Effect: The lack of a documented monitoring process increases the risk that noncompliance, audit findings, performance deficiencies, or eligibility issues could occur and remain undetected. Questioned Costs: None noted Repeat Finding: No Recommendation: We recommend that management establish formal subrecipient monitoring procedures that require documented risk assessments, review of applicable audit reports, verification of suspension and debarment status before issuing subawards, and documented follow-up on identified findings. The nature and extent of monitoring should be based on each subrecipient’s assessed risk, with sufficient documentation retained to demonstrate compliance with federal requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding; see corrective action plan.
Views of responsible officials and planned corrective actions: Management of Sunrise Community for Recovery and Wellness, Inc. agrees with this finding. Management will revise the subrecipient MOU template to include the federal award identification information required by 2 CFR 200.332 and will implement a documented review process to ensure completeness before agreements are executed. Management will also evaluate existing subrecipient MOUs and issue amendments or supplemental award notifications, as necessary, to communicate missing federal award information.
2025-001 Finding – Federal Award Type: Subrecipient Monitoring – Non-Compliance and Material Weakness in Internal Control Over Compliance (Partial repeat of Finding 2024-002) Identification of Federal Program: Assistance Listing (AL) No. 81.086 – Conservation Research and Development Program Criteria / Requirement: 2 CFR 200.303 requires non-federal entities receiving federal awards to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance that the entity is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. In accordance with 2 CFR 200.332, a pass-through entity is required to clearly identify the federal award as a subaward and provide the subrecipient with required federal award information and all applicable requirements imposed by the pass-through entity. The pass-through entity must also evaluate the risk of noncompliance for each subrecipient, monitor the activities of subrecipients to ensure that federal awards are used for authorized purposes and that performance goals are achieved, and take appropriate action when necessary. Condition / Context: Forth passed through $2,260,902 in federal funding to subrecipients under AL No. 81.086. During the audit, we noted that Forth made improvements to its subrecipient monitoring process during fiscal year 2025. Specifically, Forth established and documented a policy addressing subrecipient monitoring, including an administrative review to be completed by subrecipients and a risk assessment process for subrecipients prior to entering into new subaward agreements. We also noted that required federal award information was included in subaward agreements and, when applicable, Forth obtained and reviewed the subrecipient's audit under 2 CFR Subpart F for relevant audit findings. However, the established subrecipient monitoring policy was not consistently followed and was not applied retroactively to previously established subrecipients. Specifically, the risk assessment process was implemented for new subrecipients but was not applied to existing or previously engaged subrecipients. Additionally, Forth did not consistently maintain formal documentation evidencing ongoing monitoring activities, including regular meetings with subrecipients to assess timely completion of tasks and the provision of technical assistance when needed. Further, although a risk assessment was performed for new subrecipients, Forth had not established a systematic process to ensure that the results of the risk assessment were consistently used to determine, document, and execute the appropriate level of monitoring for each subrecipient. As a result, Forth was unable to demonstrate that its established subrecipient monitoring policy was consistently implemented and that monitoring procedures were appropriately applied based on the risk of noncompliance for each federal subrecipient. Cause: Although Forth had established a subrecipient monitoring policy, controls were not sufficient to ensure the policy was consistently implemented and applied to all applicable subrecipients. Management had not established an effective process to ensure that existing subrecipients were incorporated into the risk assessment process or that required monitoring activities and related documentation were consistently completed and retained. Effect: Failure to consistently implement and document the established subrecipient monitoring policy increases the risk that subrecipient noncompliance may not be identified, evaluated, or addressed timely. Incomplete award and monitoring documentation also limits Forth's ability to demonstrate that it exercised appropriate oversight over federal subawards and complied with the requirements of 2 CFR 200.303 and 200.332. Questioned Costs: None. Recommendation: Forth should strengthen its implementation and oversight of its existing subrecipient monitoring policy to ensure that the policy is consistently followed and applied prospectively to all applicable subrecipients. Specifically, Forth should: 1. Apply and document the required risk assessment for all subrecipients, including existing and previously engaged subrecipients, and establish procedures for periodic reassessment as appropriate; 2. Ensure that the results of each risk assessment are documented and used to determine the appropriate nature, timing, and extent of subrecipient monitoring; 3. Maintain complete and accurate documentation of subaward information and ongoing monitoring activities, including meetings, technical assistance, performance reviews, follow-up, and resolution of identified issues; and 4. Establish management review and other internal controls to verify that the subrecipient monitoring policy is consistently implemented, documented, and applied to all applicable federal subrecipients. Management should also perform a review of existing subrecipient files to identify and remediate instances where required risk assessments, monitoring documentation, or other award documentation were not completed in accordance with the established policy. Management’s Response: We agree with the auditor's comments. Forth made progress in FY2025 by establishing a documented subrecipient monitoring policy, a risk assessment process for new subawards, and including required federal award information in subaward agreements. In FY2026, we will extend the risk assessment retroactively to all existing subrecipients, formalize a written process that ties risk assessment results to a defined monitoring plan, implement a standard monitoring log to document ongoing activities, and establish a semi-annual management review to confirm consistent application - with full implementation targeted by December 31, 2026.
Criteria In accordance with 2 CFR § 200.332(a) of the Uniform Guidance, pass-through entities are required to clearly identify to the subrecipient certain information and requirements at the time of the subaward, including federal award identification information, applicable compliance requirements, and additional terms and conditions imposed by the pass-through entity. The agreements should also include the applicable U.S. Department of Transportation and Federal Aviation Administration award terms, conditions, and assurances. Condition During our audit of the Airport Improvement Program grants awarded to the Town, we noted that the Town executed written subrecipient agreements with Fishers Island Ferry District for $2,401,993 passed through for the Airport Improvement Program (Assistance Listing 20.106), however the agreements contained errors and omitted required information. Cause The Town did not have adequate procedures in place to ensure that subrecipient agreements were accurate, complete, and included all applicable federal award requirements. Effect Incomplete or inaccurate subrecipient agreements increase the risk that the subrecipient may not fully understand or comply with federal award requirements. This could result in noncompliance with federal regulations, potential misuse of funds, and questioned costs. Additionally, the Town is not in full compliance with the Uniform Guidance. Questioned Costs Unknown Recommendation We recommend that the Town develop and implement procedures to ensure that all subrecipient agreements are reviewed for accuracy and completeness and include all required information specific to the grant award.
Reference Number: 2025-005 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services Federal Program: Social Services Block Grant Assistance Listing Number: 93.667 Pass-Through Entity: New York State Office of Temporary and Disability Assistance Pass-Through Entity Identifying Number and Period: 18000 (Multiple) (1/1/2025-12/31/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR 200.332(c), a pass-through entity must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward, and must monitor the overall performance of the subrecipient to ensure that the goals and objectives of the subaward are achieved. Subrecipient monitoring must include reviewing financial and performance reports, following up and ensuring that the subrecipient takes timely and appropriate action on deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity, issuing management decisions for applicable audit findings, and verifying that the subrecipient is audited as required by Subpart F when applicable. Control: Per 2 CFR section 200.303(a), the recipient and subrecipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The County did not maintain documentation that it performed an evaluation of subrecipients’ fraud risk and risk of noncompliance prior to issuance of subawards. Context: For five of five subrecipients selected for testing, the County was unable to provide documentation demonstrating that a program supervisor performed fraud risk and noncompliance risk assessments before the related subawards were issued. Although the County performed general monitoring activities for these subrecipients, the monitoring procedures were not based on documented evaluations of each subrecipient’s individual risk. Questioned costs: Undetermined. Known questioned costs could not be quantified because the County did not maintain documentation of the required subrecipient risk assessments; therefore, the amount of Federal expenditures, if any, affected by the exception could not be determined. Cause: The County’s procedures did not ensure that subrecipient fraud risk and risk of noncompliance were evaluated and documented before subaward issuance. Effect: Without documented risk assessments, the County may not have established appropriate monitoring procedures to address each subrecipient’s fraud risk and risk of noncompliance with program requirements. Recommendation: The County should strengthen procedures and internal controls to ensure subrecipient fraud risk and risk of noncompliance assessments are performed and documented before subaward issuance and that supporting documentation is retained and available for audit. Views of responsible officials: Management agrees with the finding and will perform corrective actions noted on the corresponding Corrective Action Plan.
Condition: During our testing of subrecipient monitoring activities, we noted that the Organization did not verify that subrecipients were not suspended, debarred, or otherwise excluded from participation in federal programs prior to issuing subawards. In addition, the Organization's subaward agreements did not include all information required by Uniform Guidance, such as applicable federal award identification information, indirect cost rate information, and other required terms and conditions. Criteria: 2 CFR 200.332(a) requires pass-through entities to verify that subrecipients are not suspended, debarred, or otherwise excluded from receiving federal funds. 2 CFR 200.332(b) requires pass-through entities to clearly identify federal award information and communicate specified terms and conditions within the subaward agreement, including applicable federal award identification information, indirect cost rate information, and other required compliance provisions. Cause: The Organization was not aware of the specific Uniform Guidance requirements related to verifying subrecipient eligibility and including required information in subaward agreements. As a result, the Organization had not established formal procedures to ensure compliance with these requirements. Effect: Not verifying that subrecipients are not suspended, debarred, or otherwise excluded may result in federal funds being provided to ineligible entities. Subaward agreements lacking required information may result in subrecipients not receiving critical federal award information, increasing the risk of noncompliance and questioned costs associated with federal awards. Context: The Organization had one subrecipient under the major program. We found no evidence that the Organization performed or documented a verification of subrecipient eligibility. We also noted that the subaward agreement did not contain all information required by 2 CFR 200.332(b). Recommendation: We recommend that the Organization develop and implement formal written procedures for subrecipient monitoring that include: 1. Verifying and documenting that each subrecipient is not suspended, debarred, or otherwise excluded from participation in federal programs through review of the SAM.gov or other appropriate sources. 2. Updating subaward agreements and related templates to ensure all information required by 2 CFR 200.332(b) is included. 3. Periodically reviewing subrecipient monitoring procedures and subaward agreement templates to ensure ongoing compliance with Uniform Guidance requirements. Views of Responsible Officials: Management agrees with the finding.
Finding: Item 2025-001 – Subrecipient Risk Assessments Not Performed or Documented Significant Deficiency Federal Program – Regional Technology and Innovation Hubs Assistance Listing Number – 11.039 Federal Agency – Economic Development Administration Pass-through Grantor's Numbers – N/A Federal Award Year – December 31, 2025 Criteria: 2 CFR 200.332(c) requires that pass-through entities evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. This evaluation should be documented and used to support the nature, timing, and extent of subrecipient monitoring procedures performed. Condition/context: The Foundation had not established or documented an ongoing risk assessment process for evaluating the fraud risk and risk of noncompliance for each subrecipient, as required by Uniform Guidance. Although the Foundation performed various subrecipient monitoring activities, it did not document the basis for determining the nature, timing, and extent of those procedures. Cause: The Foundation had not established formal written procedures requiring the completion and documentation of subrecipient risk assessments. Management relied on existing monitoring activities, including the review of subrecipient reports, expenditure documentation, ongoing communication with subrecipients, and knowledge of subrecipient experience with federal awards; however, a formal process had not been implemented to evaluate and document subrecipient risk in accordance with Uniform Guidance requirements. Effect: The lack of documented subrecipient risk assessments could result in monitoring procedures that are not appropriately designed to address each subrecipient's fraud risk and risk of noncompliance with federal award requirements. This could lead to instances of noncompliance, questioned costs, or requests for corrective action by federal agencies. Questioned cost: Not applicable. Repeat finding: No. Recommendation: The Foundation should establish, document, and maintain effective internal control procedures over subrecipient monitoring to provide reasonable assurance that subrecipients are managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These procedures should include a documented evaluation of subrecipient risk, as required by 2 CFR 200.332, to support the appropriate level of monitoring performed for each subrecipient. View of responsible officials: Management's response is reported in "Corrective Action Plan" at the end of this report.
Findings and Questioned Costs Relating to Federal Awards Finding Reference Number: 2025-001 Bassett Health Network Research and Development Cluster (93.262) Federal Award Number: U54OH007542, 23U01OH012656, R01OH011668, U13OH01282 Federal Award Year: 2025 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness and Material Noncompliance Prior Year Finding: N/A Statistically Valid Sample: No Criteria Title 2 of the Code of Federal Regulations, Part 200 — Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200) section 200.332(c) states a passthrough entity should evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider: 1) The subrecipient’s prior experience with the same or similar subawards; 2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; and 4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Further, 2 CFR 200.332(e) states that a pass-through entity must monitor the activities of a subrecipient as necessary to ensure compliance with Federal statutes, regulations, and subaward terms and conditions and to ensure the goals and objectives of the subaward are achieved. At a minimum, monitoring must include: (1) Reviewing financial and performance reports; (2) Ensuring the subrecipient takes corrective action on significant developments that negatively affect the subaward (including relevant Single Audit findings, other audit findings, site visits, and written notifications of adverse conditions); (3) Issuing a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, as required by § 200.521; and (4) Resolving audit findings specifically related to the subaward. Additionally, 2 CFR 200.332(f) states a pass-through must, depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in 2 CFR 200.332(c)), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in 2 CFR 200.425. Also, 2 CFR 200.332(g) requires the pass-through entity to verify that a subrecipient is audited as required by Subpart F of Part 200. Lastly 2 CFR 200.303(a) states, recipient and subrecipients of federal awards must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During the year ended December 31, 2025 Bassett Health Network (the Network) passed through $166,774 of federal funding to subrecipients as it relates to the Research and Development Cluster. As part of our testing related to subrecipient monitoring, we identified the following: A. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide support evidencing the evaluation of the subrecipients’ fraud risk and risk of noncompliance risk. B. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide evidence of considering or performing additional monitoring procedures based on the subrecipient’s risk evaluation. C. For 3 out of 3 subrecipients selected for testwork, the Network was unable to provide evidence that the Network reviewed that the subrecipient receives a Single Audit in accordance with subpart F. Cause The cause of the condition was a lack of sufficiently documented and implemented policies, procedures, and internal controls to ensure that required subrecipient monitoring activities were performed and adequately documented in accordance with federal requirements. Effect Failure to perform annual risk assessments to determine appropriate subrecipient monitoring procedures, as well as failure to verify and review subrecipient Single Audit reports, may result in insufficient oversight to detect subrecipient noncompliance with Federal statutes, regulations, and the terms and conditions of the award. Further, the lack of timely audit reviews limits the Network’s ability to ensure subrecipients take prompt corrective action on significant developments or deficiencies affecting the subaward. Questioned Costs None. Recommendation We recommend the Network develop written policies and procedures to ensure that all required subrecipient monitoring activities, both identified through risk assessments and through review of Single Audits, are consistently performed and adequately documented in accordance with Federal requirements and the terms and conditions of the subawards. Such documentation should provide clear and sufficient evidence that required risk assessment and monitoring procedures have been completed, including documentation that demonstrates what was performed, when it was performed, who performed it, the results of the monitoring activities, and any follow‑up actions or issues identified, as applicable. View of Responsible Officials Recommendation accepted. Please see corrective action plan.
The following findings represent significant deficiencies and/or instances of noncompliance, including questioned costs, required to be reported in accordance with Uniform Guidance 2 CFR 200.516. Finding Number 2025‐001 Program: Continuum of Care Assistance Listing Number: 14.267 Federal Grantor: U.S. Department of Housing and Urban Development Passed‐through: N/A – Direct Assistance Award No. and Year: MD0523H3G012200 (2025) Compliance Requirements: Reporting – Annual Audit of Financial Statements and Schedule of Expenditures of Federal Awards Type of Finding: Instance of Non‐Compliance Criteria: Under the Uniform Guidance, a pass‐through entity is required to ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required federal award identification information. Required subaward information includes, among other items, the federal award, the subrecipient name and unique entity identifier, the Assistance Listing title and number, the dollar amount made available under each federal award, and the Assistance Listing number at the time of disbursement. If any required data elements change, the changes must be included in subsequent subaward notifications, and when certain information is not available, the pass‐through entity must provide the best information available to describe the federal award and subaward. In addition, 2 CFR § 200.332 requires a pass‐through entity to evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring needed. In performing this evaluation, the pass‐through entity should consider factors such as the subrecipient’s prior experience with the same or similar subawards, results of previous audits, whether the subrecipient has new personnel or new or substantially changed systems, and the extent and results of any monitoring by the federal agency. Section III – Federal Award Findings and Questioned Costs (continued) Condition: During our testing of the Continuum of Care Program subrecipient monitoring compliance requirement, we noted that the Organization did not maintain sufficient documentation to demonstrate compliance with certain pass‐through entity requirements under 2 CFR § 200.332. Specifically, for the items tested, the following required elements were not clearly evident or documented: 1. Subrecipient identification on the subaward — The subrecipient name and unique entity identifier were not clearly evident on the subaward documentation. 2. Federal award identification and funding information — The subaward documentation and related disbursement support did not clearly identify the federal award, the Assistance Listing Number and Name. 3. Subrecipient risk assessment — The Organization did not document that it evaluated each subrecipient’s risk of noncompliance for the purpose of determining the appropriate level and nature of subrecipient monitoring related to the subaward. Context: The Organization received and administered HUD Continuum of Care Program funding during the year ended December 31, 2025. The Organization acted as a pass‐through entity for certain program funds and made subawards to a subrecipient to carry out program activities. Our audit procedures included testing a sample of $225,115 in subawards, representing all subrecipient disbursements during the audit year. We identified five exceptions related to required subaward identification information and documented subrecipient risk assessments. Cause: The Organization did not have sufficiently designed or consistently implemented procedures to ensure that all required federal award identification elements were included in subaward documentation and communicated at the time of disbursement. In addition, the Organization’s subrecipient monitoring process did not include a formal, documented risk assessment process for each subrecipient, or such documentation was not retained in a manner sufficient to demonstrate compliance. Effect / Potential Effect: Failure to include required federal award identification information in subaward documents and at the time of disbursement may result in subrecipients not being adequately informed of applicable federal award requirements, including the specific federal program, Assistance Listing information, and amount of federal funds subject to compliance requirements. Section III – Federal Award Findings and Questioned Costs (continued) Effect / Potential Effect: (continued) Failure to document subrecipient risk assessments may result in the Organization not identifying subrecipients, requiring enhanced monitoring or additional award conditions. As a result, monitoring activities may not be appropriately tailored to the subrecipient’s risk of noncompliance, which could increase the risk that program funds are not administered in accordance with federal statutes, regulations, and the terms and conditions of the federal award. Questioned Costs: No questioned costs were identified as a result of this finding because the exceptions noted relate to required subaward identification, communication, and risk assessment documentation, and the audit procedures performed did not identify specific unallowable costs associated with these exceptions. Recommendation: We recommend that the Organization strengthen its policies and procedures over subrecipient monitoring to ensure compliance with 2 CFR § 200.332. Such procedures should include, at a minimum: 1. Standardized subaward templates that require inclusion of all applicable federal award identification elements, including subrecipient name, unique entity identifier, Assistance Listing Number and Name, federal award identification information, the amount of federal funds obligated or made available, and other required subaward terms. 2. Disbursement‐level review procedures to ensure the Assistance Listing number and applicable federal award information are identified and communicated when required at the time of disbursement. 3. Documented risk assessments for each subrecipient, performed and retained in the grant file, that consider relevant risk factors such as prior experience with similar awards, audit results, changes in personnel or systems, and results of federal or other monitoring. 4. Risk‐based monitoring plans that link the results of each subrecipient’s risk assessment to the type, timing, and extent of monitoring activities to be performed. 5. Supervisory review and retention controls to verify that required subaward information and risk assessment documentation are complete before subawards are executed and funds are disbursed. Views of Responsible Officials / Corrective Action Plan: Management agrees and will implement our recommendations.
Finding 2025-001 Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Social Services Block Grant Assistance Listing Number: 93.667 Federal Award Identification Number and Year: 2401NVSOSR 2025 Pass-Through Agency: State of Nevada, Department of Health and Human Services Pass-Through Number(s): 2401NVSOSR Award Period: January 1, 2025 – December 31, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance and Other Matters Criteria or specific requirement: In accordance with the Compliance Supplement, Part 6 - Internal Control, CFR § 200.303(a) requires that non-Federal entities must establish and maintain effective internal control over Federal awards that provides reasonable assurance the entity is managing Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, 2 CFR § 200.332(g) requires pass-through entities to verify that subrecipients expected to be audited under 2 CFR Part 200, Subpart F have met the applicable audit requirements and follow-up on any findings and corrective action as part of its subrecipient monitoring requirements. Condition: Management did not retain documentation demonstrating their monitoring procedures over annual audits under 2 CFR Part 200, Subpart F had been met. During our testing of internal controls over subrecipient monitoring compliance requirements, we noted that the Organization had not designed and implemented documented controls to verify that subrecipients subject to audit requirements under 2 CFR Part 200, Subpart F had met the requirements for annual audits. Questioned costs: None. Context: Subrecipient monitoring over federal annual audit requirements was not reviewed and documented for all three subrecipients during the current reporting period. Cause: The Organization did not have documented internal controls designed to ensure verification of annual audit requirements as part of its subrecipient monitoring procedures. Effect: Without a documented control to verify subrecipient audit requirements, management may not timely identify subrecipients subject to Single Audit requirements or instances in which required audits have not been completed. As a result, subrecipient noncompliance could occur and not be detected in a timely manner. Repeat Finding: No. Recommendation: Management should establish internal control procedures to ensure formal documentation of the annual verification of whether subrecipients are subject to audit requirements and, if applicable, that required audits have been completed. Documentation should be retained to support the procedures performed, including information obtained from subrecipients, management's assessment of audit requirements, and any follow-up actions taken. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Older Americans Act Title III Assistance Listing Number: 93.044, 93.045, 93.053 Federal Award Identification Number and Year: 2401MNOASS-00, 2501MNOASS-00, 2401MNOACM- 00, 2501MNOACM-00, 2401MNOAHD-00, 2501MNOAHD-00, 2401MNOANS-00, 2501MNOANS-01, 2601MNOANS-02 - 2025 Pass-Through Agency: Minnesota Board on Aging Award Period: January 1, 2025 – December 31, 2025 Types of Findings Material Weakness in Internal Control over Compliance Material Noncompliance Criteria: The organization does not retain documentation to ensure subrecipients are not excluded or disqualified in accordance with 2 CFR 180.300 (2 CFR 200.332(a)). Condition: The organization did not retain documentation that they had performed proper procedures to ensure subrecipients were not suspended or debarred. Questioned costs: None Context: For the 5 out of 5 subrecipients tested, there was no proof that suspension and debarment searches were completed. Cause: The Organization had miscommunication between the contract manager and the financial manager on who should be retaining the searches. Effect: The Organization could have entered into an agreement with a subrecipient that was suspended or debarred. Although the Organization was able to demonstrate that contracts were not entered into with subrecipients who were suspended or debarred, the absence of documentation performed prior to contract execution presents a risk of noncompliance. Repeat Finding: No. Recommendation: The Organization should save the suspension and debarment searches. Views of Responsible Officials: There is no disagreement with the audit finding. Management will implement a process to save the suspension and debarment.
Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Older Americans Act Title III Assistance Listing Number: 93.044, 93.045, 93.053 Federal Award Identification Number and Year: 2401MNOASS-00, 2501MNOASS-00, 2401MNOACM- 00, 2501MNOACM-00, 2401MNOAHD-00, 2501MNOAHD-00, 2401MNOANS-00, 2501MNOANS-01, 2601MNOANS-02 - 2025 Pass-Through Agency: Minnesota Board on Aging Award Period: January 1, 2025 – December 31, 2025 Types of Findings Material Weakness in Internal Control over Compliance Criteria: The organization does not retain documentation to ensure the risk assessments and monitoring activities are reviewed after completion as required by 2 CFR 200.332(c) and Subpart F. Condition: The organization did not retain documentation to support that the subrecipient monitoring activities and risk assessments were being reviewed. Questioned costs: None Context: For the 5 out of 5 subrecipients tested, there was no proof that the monitoring and assessments were being reviewed. Cause: The Organization was not aware of the need to document their review of the monitoring activities and risk assessments. Effect: The Organization could have missed performed required monitoring activities or risk assessments.. Repeat Finding: No. Recommendation: The Organization should retain documentation that the monitoring activities and risk assessments were reviewed. Views of Responsible Officials: There is no disagreement with the audit finding. Management will implement a process to document their review.
Finding 2025-002 United States Department of Agriculture - Forest Service Federal Assistance Listing No. 10.727 Inflation Reduction Act (IRA) Baltimore Tree Trust Significant Deficiency in Internal Controls and Noncompliance Over Subrecipient Monitoring Repeat Finding: No Condition: For 1 out 1 subrecipient, the subaward agreement did not identify the unique entity identifier (UEI), the Federal Award Identification Number (FAIN), and Assistance Listing Number (AL) as required. Management also did not establish and implement adequate written policies and procedures for monitoring subrecipients. For 1 out 1 subrecipient, we were unable to substantiate that BTT reported the first-tier subaward made to Blue Water Baltimore in accordance with the applicable Federal award terms. The subaward met the applicable $30,000 Federal funding threshold for reporting; however, BTT was unable to provide sufficient documentation demonstrating that the required subaward reporting was completed. Criteria: In accordance with 2 CFR §200.303, the non-federal entity must establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, FAIN, identification of whether the award is R&D and indirect cost rate for the federal award. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (f) Determine whether the PTE has written subrecipient monitoring policies and procedures that address the identification of subawards, assessment of subrecipient risk of noncompliance, and performance of monitoring procedures based on identified risks. (g) Per grant agreement, in accordance with the applicable Federal award terms, unless otherwise exempt, the PTE is required to report each first-tier subaward action that equals or exceeds 30,000 in Federal funds awarded to a non-Federal entity or Federal agency. The non-Federal entity or Federal agency must report each applicable obligating action described in paragraph (g) of the award terms to fsrs.gov. For subaward information, the report must be submitted no later than the end of the month following the month in which the obligation was made Cause: Management did not have adequate written procedures or controls in place to ensure that all required federal award information and applicable requirements were identified and incorporated into subaward agreements. Specifically, management did not have a formal review process to verify the inclusion of the UEI, FAIN, ALN, and applicable federal award requirements before subawards were executed. Effect: BTT was not in compliance with subrecipient monitoring requirements of the grant under the Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that BTT establish and implement written policies and procedures to ensure that all subaward agreements include the required Federal information, including the UEI, FAIN, and ALN. BTT should also establish procedures to ensure that subrecipients are properly monitored and that all first-tier subawards meet the applicable reporting threshold are reported timely and accurately in accordance with Federal requirements. BTT should maintain sufficient documentation to demonstrate that required subaward reporting and monitoring activities were completed. Auditee Response and Corrective Action Plan: Refer to management’s corrective action plans. Auditor’s Conclusion: Finding remains as stated.
Corporation for National and Community Service Federal Financial Assistance Listing #94.012, 22BIICA001 10/1/2022 – 9/30/2025, 23BIACA001 10/1/2023 – 9/30/2026, 23BIFNY001 10/1/2023 – 9/30/2026 Americorps September 11th National Day of Service and Remembrance Grants Subrecipient Monitoring Material Weakness in Internal Controls over Compliance and Material Noncompliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. 2 CFR 200.332 identifies the requirements for all pass-through entities surrounding subrecipient monitoring and management. Condition: We noted the following during testing; a) Subawards did not contain minimum required elements in accordance with 2 CFR 200.332(b) b) The Organization did not consider all suggested elements when evaluating subgrantee’s fraud risk and risk of noncompliance with subaward in accordance with 2 CFR 200.332(c) c) Documentation could not be provided to substantiate whether suspension and debarment was considered prior to awarding the subgrant d) The Organization required the subgrantee to complete performance reports, however, did not require completion of a financial report in accordance with 2 CFR 200.332(e)(1) e) The Organization did not consider whether subgrantee was required to be audited and therefore did not review whether subgrantee had deficiencies reported over the federal program in accordance with 2 CFR 200.332(e)(2) through 2 CFR 200.332(e)(4) Cause: Management was not familiar with all subrecipient monitoring requirements as published under 2 CFR 200.332. The Organization adopted a subrecipient monitoring policy during quarter 4 of 2025. Effect: Without full understanding of subrecipient monitoring requirements under 2 CFR 200.332, demonstrating that the program complies with laws, regulations, and other compliance requirements is difficult. Questioned Costs: None reported. Context/Sampling: Seven out of thirty six subrecipients were reviewed for testing. Repeat Finding from Prior Year: Yes, prior year finding 2024-005. Recommendation: We recommend management to review subrecipient monitoring requirements as published under 2 CFR 200.332 and adopt a subrecipient monitoring policy. Views of Responsible Officials: Management is in agreement.
FINDING 2025-007 Subject: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds - Subrecipient Monitoring Federal Agency: Department of the Treasury Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds Assistance Listings Number: 21.027 Federal Award Number and Year (or Other Identifying Number): FY2021 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Other Matters Condition and Context The County expended $1,810,837 in COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (SLFRF) during the audit period. Of that amount, $6,014 was passed through to one subrecipient. As a pass-through entity, the County was required to identify the award and applicable requirements and monitor the subrecipients. Procedures to monitor its subrecipients included reviewing the quarterly financial and performance reports as required by the County through the Subrecipient Agreements. No quarterly financial and performance reports were submitted to the County during the audit period. As part of the monitoring the County performed on subrecipients in prior audit periods, they noted subrecipients had been missing reports. Despite having received quarterly reports in prior audit periods, no quarterly reports were submitted for the current audit period. The lack of effective internal controls and noncompliance were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states in part: "All pass-through entities must: . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing the financial and performance reports required by the pass-through entity. . . ." INDIANA STATE BOARD OF ACCOUNTS 27 FLOYD COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Cause The County's agreements with the subrecipients included quarterly financial and performance reporting requirements, but no procedures were in place to ensure timely and appropriate reporting occurred. The County's oversight process for monitoring subrecipient financial and performance reporting for the audit period did not include adequate follow-up procedures to ensure that required reports were submitted. Subrecipients did not submit the quarterly reports as requested by the County. Effect Without the proper implementation of an effectively designed system of internal controls, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. The lack of sufficient internal controls resulted in the County receiving none of the required quarterly financial and performance reports from its subrecipients during the year. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County strengthen its system of internal controls to ensure that subrecipients are submitting their financial and performance reports timely and accurately, so that the County can comply with the Subrecipient Monitoring compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
Subrecipient Monitoring and Special Tests: Housing Quality Standards Federal Department – U.S. Department of Housing and Urban Development Federal Award Identification Number and Year: M17-DC170213 and 2017 M18-DC170213 and 2018 M21-DC170213 and 2021 M22-DC170213 and 2022 Home Investment Partnerships Program (HOME), Federal Assistance Listing #14.239 County Department – Department of Planning and Development (DPD) Finding 2025 – 001 CRITERIA Subrecipient Monitoring 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D—Post Federal Award Requirements Standards for Financial and Program Management, Section 200.303 Internal controls states, “the recipient and subrecipient must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:(1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.(4) Resolve audit findings specifically related to the subaward…. (g)Verify that a subrecipient is audited as required by subpart F of this part. (h) Consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. (i) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations. DPD’s HOME Program Policies and Procedures Manual (updated January 2025), Monitoring Section (pages 114 to 129), under the Annual Monitoring Plan/Schedule Update, states the plan should identify the participating jurisdiction (PJ) monitoring goals and strategies, highlighting areas to which staff should pay special attention during the monitoring year. A specific schedule detailing annual, bi-annual, and tri-annual monitoring visits as required by HUD must be developed and maintained. To assure that adequate records are kept regarding each property and its compliance status, the monitor should establish a monitoring file for each property. The basic items in the file should include written agreement, written tenant selection criteria, property and unit inspections and results, etc. Also, HOME Program Compliance should conduct a risk assessment of its portfolio of the PJ’s HOME projects so that the highest risk projects can be identified and monitored first. In addition, HOME Program Compliance must conduct a desk review of all properties in the monitoring workload each year, as well as on-site reviews periodically, ranging from annually to every 3 years based on the number of units in property (i.e. 26 or more units require an annual review). Special Tests: Housing Quality Standards Per 24 CFR Section 92.209(i), Tenant-based rental assistance: Eligible costs and requirements, Housing Standards, states “The participating jurisdiction must require the housing occupied by a family receiving tenant-based rental assistance under this section to meet the participating jurisdiction's property standards under § 92.251. Initially and annually thereafter, the participating jurisdiction must determine the housing complies with its property standards and is decent, safe, sanitary, and in good repair in accordance with § 92.251(f). During the period of affordability (i.e., the period for which the nonfederal entity must maintain subsidized housing) for HOME assisted rental housing, the PJ must perform on-site inspections to determine compliance with property standards and verify the information submitted by the owners no less than (a) every three years for projects containing one to four units, (b) every two years for projects containing five to 25 units, and (c) every year for projects containing 26 or more units. CONDITION During the current audit period, the Cook County Department of Planning and Development (DPD) did not provide sufficient evidence to document annual monitoring performed, as well as performed the required inspections to ensure property standards were met, as required by Federal regulations and its internal policies. CAUSE Based on discussions with management, the cause of the findings occurred as a result of post pandemic allocations to the County which included several housing related fundings and initiatives, including Emergency Rental Assistance I & II (ERA I& II), Homeless Sheltering, Homeless and Transitional Sheltering Physical Site Acquisition and Development, HOME ARPA (HUD Allocation), and HOME, CDBG CV development delays that challenged the Housing teams provision of services and compliance requirement. While HUD had extended post pandemic compliance moratoriums into fiscal year 2024, Housing team hiring, training and implementation of compliance activities were unable to activate fully in the subject fiscal year to meet compliance. Additionally, for subrecipient monitoring of the HOME program, costs paid to developers were misclassified as subrecipient expenditures. The HOME program does not have contracts with subrecipients. EFFECT Failure to adequately monitor the activities and performance of subrecipients (and developers) could result in Federal awards being used for unauthorized purposes and DPD’s inability to adequately perform required risk assessments. Failure to perform the required inspections to ensure property standards were met is a violation of Federal regulations. QUESTIONED COSTS None. CONTEXT Subrecipient Monitoring During the current audit period, we noted a total of thirty-seven (37) projects were included on the Program Year 2024 (Fiscal Year 2025) HOME monitoring rental portfolio schedule provided, which required annual monitoring per DPD’s internal policies. Of the 37 projects, we noted three projects had some monitoring conducted during the period, which included some review of tenant files (for income verification/eligibility) and limited physical inspections of HOME units. No additional documentation was provided to verify compliance with federal regulations and the HOME Program Policies and Procedures Manual which required annual monitoring of each project (property). In addition, we noted approximately $7.3 million was reported on the SEFA as pass-through to two subrecipients under the program for the fiscal year ended November 30, 2025. Based on further discussions, DPD noted that these subrecipients are the two title companies used to pay the developers under the HOME program in accordance with its escrow agreement(s). We also reviewed a sample of these payments noting the supporting documentation referenced the developers as subrecipients. No documentation was provided to support compliance with subrecipient monitoring as required by 2 CFR Part 200.332. Special Tests: Housing Quality Standards We were provided with the same 37 projects reviewed under subrecipient monitoring to verify that DPD performed the required inspections to ensure that property standards were met. Based on our review, we noted the list included projects with HOME assisted units ranging from one (1) to 99 units, which would have required inspections every one to three years. However, the listing provided did not identify those units on which housing quality inspections were due. In addition, of the 37 projects, we were provided with documentary evidence to support only one (1) project whereby the required unit inspection reports were completed. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend DPD ensure procedures should be in place to ensure adequate documentation is maintained to support the evaluation of each subrecipient’s risk of noncompliance, as required by Federal regulations and internal policies. Also, documentation should be maintained to support that required inspections are performed to ensure that property standards are met, including identification of those units on which housing quality inspections are due, in accordance with 24 CFR 92.251(f). VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 42-43.
Subrecipient Monitoring Federal Department – U.S. Department of Treasury Federal Award Identification Number and Year: SLFRP0143 and 2021 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds, Federal Assistance Listing #21.027 County Department(s) – Various Finding 2025 – 002 CRITERIA 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Section 200.332. Requirements for pass-through entities, requires that “A pass-through entity must: (b) ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: (1) Federal award identification. (i) Subrecipient's name (must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN)…(c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency)... (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. The Cook County, Illinois ARPA: Subrecipient Risk Assessment and Risk Reassessment Process Manual (dated May 16, 2024), states "If a subrecipient does not complete the risk reassessment by the assigned due date, their risk level will remain the same and they will be eligible for reimbursements only. Advancement requests will not be considered until the subrecipient completes the risk reassessment." Also, the level of monitoring to which the subrecipient must adhere to will vary by risk level assigned. The monitoring expectations associated with each risk level will be communicated to the subrecipient in the form of the risk reassessment and financial monitoring letter”. The monitoring parameters associated with each risk level are outlined below: • High Risk – minimum of monthly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Medium Risk – minimum of monthly to quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns • Low Risk - minimum of quarterly check-ins with County to share program progress, updates, and share programmatic questions/concerns The Cook County ARPA Grants Compliance Guide, under External Risk Management, states "Federal grant regulations in Uniform Guidance require that all SLFRF-funded programs be conducted in a risk-informed manner, particularly the selection and monitoring of subrecipients that implement programming on behalf of Cook County. In order to assess the risk potential of external subrecipient partners, each subrecipient organization is assessed for risk as the beginning of their partnership with the County and assigned a risk rating of High, Medium, or Low. This rating informs the monitoring and documentation requirements for that subrecipient. Subrecipients are reassessed for risk annually to reflect any changes or improvements in their risk potential”. The Cook County ARPA SLFRG Grant Subaward Financial Management Manual (revised March 3, 2025), under Subaward Financial Management Roles and Responsibilities states that “as outlined in the risk assessment form, the level of monitoring will be based on subrecipient’s risk designation. The subrecipient will receive a risk assessment and financial management letter apprising it of the expectations associated with its assigned risk level”. In addition, under Section A. Advancement of Funds Process, Item VI. Shifting to Reimbursement Model, states “nine months prior to the program’s conclusion, no further advancements can be provided to a subrecipient. Unspent advance balances will be applied against subsequent expenses incurred and reported to the County. Some subrecipients may need working capital to maintain operations, and it will be the responsibility of the Department to create a drawdown schedule to ensure to the best of its ability that all advanced funds are expended and/or recouped by program-end”. CONDITION During the current audit period, the County performed inadequate monitoring of its subrecipients as required by its internal policies. CAUSE Based on discussions with management, the County instituted new internal guidelines for program and financial management of its State and Local Fiscal Recovery Funds (SLFRF) award. These guidelines included more strict monitoring controls than federal regulations require. Additionally, the County deployed a new grants management system specifically to assist in collection and reporting on program metrics and subrecipient financials. The grants management system went live in spring of 2024. The County continues to invest in compliance oversight and technical assistance to ensure its new guidelines are effectively implemented, particularly in relation to utilization of its grants management system. EFFECT Failure to adequately perform and document the risk assessments on its subrecipient(s) could result in inadequate monitoring of the activities and performance of a subrecipient. Also, this could result in Federal awards being used by the subrecipient for unauthorized purposes. QUESTIONED COSTS None. CONTEXT During our review of 40 subrecipients (of a population of 250 subrecipients), we noted the following: For 1 subrecipient file, we noted one (1) monitoring log was completed. However, based on risk rating(s) assigned, a total of four (4) monitoring logs were required. For 11 subrecipients, we noted the risk reassessments were expired, ranging from 167 to 920 days over the assigned due date. Of the 11 subrecipients, 6 had risk reassessments currently outstanding and 3 had advancement requests approved without a risk reassessment, both of which were contrary to County’s internal policies. The total amount advanced to the 3 subrecipients was $772,214. We noted one subrecipient submitted advancement requests totaling $852,757 during the County’s fiscal year. Based on review of the supporting documentation, it appears these funds are actual reimbursement of costs previously incurred by the subrecipient and should have been submitted via a payment request(s) as opposed to an advancement request(s). Consequently, the SEFA reported total expenditures incurred of $594,815, instead of the total $852,757, resulting in a net understatement of $257,942. However, the subrecipient was compensated for all work that was performed. We noted the County executed a subrecipient agreement (signed December 20, 2024) prior to verifying the subrecipient had an active Unique Entity Identifier (UEI) number (active date January 20, 2025) which is required by Federal regulation. IDENTIFICATION OF REPEATED FINDINGS None. RECOMMENDATION We recommend County implement procedures to ensure adequate documentation (monitoring log) is maintained and timely completion of risk reassessment is conducted to support the evaluation of each subrecipient’s risk of noncompliance as required by Federal regulations and its internal policies. Also, the County should adhere to its written internal policies which require that advancement requests not be considered until the subrecipient completes the risk reassessment. In addition, the agreement with a subrecipient should not be executed without an active UEI, unless exceptions to these policies are clearly documented. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTIONS The County agrees with the finding and recommendation. The County’s corrective action plan is on pages 44-45.