Finding Number: 2025-003 Federal Program: Coronavirus State and Local Fiscal Recovery Funds Federal Award Identification Number: 31-6400223 Assistance Listing Number (ALN): 21.027 Federal Awarding Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Pass-through Entity: Direct Award Repeat Finding: No Prior Audit Finding Number: N/A Significant Deficiency and Noncompliance – Subrecipient Monitoring Criteria Under 2 CFR § 200.332, pass-through entities are required to monitor the activities of subrecipients to ensure compliance with applicable federal statutes, regulations, and the terms and conditions of the subaward. This includes reviewing financial and performance reports, following up on deficiencies, and ensuring corrective action is taken. Condition During our testing of three subrecipient agreements, we noted that the City did not perform or document monitoring procedures for one subrecipient. Specifically, there was no evidence of review of financial reports, site visits, or other oversight activities for this subrecipient during the audit period. This condition only applies to subawards below a certain threshold, of which, the subrecipient activity is immaterial. For subawards above that threshold, the City utilizes a third-party consulting firm to perform subrecipient monitoring. The subawards tested that were monitored by the consulting firm did not indicate noncompliance. Cause The City does not have a consistent process in place to ensure all subrecipients are monitored in accordance with federal requirements. In this instance, monitoring procedures were either not performed or not documented. Effect Without proper monitoring, the City cannot ensure that subrecipients are using funds in compliance with program requirements. This increases the risk of noncompliance, improper use of funds, and undetected errors or irregularities. Recommendation We recommend the City implement and consistently follow formal subrecipient monitoring procedures. These should include documenting reviews of financial and performance reports, performing risk-based monitoring activities, and maintaining evidence of oversight for each subrecipient. Officials’ Response: See Corrective Action Plan.
Finding Number: 2025-004 Finding Type: Federal award finding Federal Assistance Listing No.: 15.685 Program Name: National Fish Passage Federal Agency: U.S. Department of the Interior Pass-Through Entity: n/a Grant Number: F24AC01768-00 Award Project Period: July 1, 2024 through July 1, 2029 Control Deficiency Type: Significant deficiency Instance of Noncompliance: Yes Compliance Requirement: Subrecipient monitoring Repeat Finding: No Criteria: Under 2 CFR 200.332 a pass-through entity must: • Evaluate each subrecipient’s risk of compliance to determine appropriate monitoring • Conduct monitoring activities based on risk, which may include reviewing financial and programmatic reports, following up on deficiencies, and verifying that subrecipients have required audits • Verify that subrecipients are not suspended or debarred prior to issuing a subaward • Ensure subrecipients submit required reports timely and comply with federal requirements • Include all applicable requirements imposed, including audit requirements under 2 CFR 200 Subpart F, the subaward • Issue management decisions for audit findings within 6 months of receiving the audit report Condition: The Council did not fully implement the required subrecipient monitoring procedures for its federal subaward. Specifically: • A formal written risk assessment was not performed prior to issuing the subaward. The Council relied on its prior working relationship with and knowledge of the subrecipient on non-federally funded projects rather than evaluating federal compliance risk. • Procurement and suspension/debarment verification were performed after the start of the subaward date. • Monitoring procedures performed were not thoroughly documented • The subaward did not include certain necessary language related the audit requirements under 2 CFR 200, Subpart F Cause: This is the Council’s first experience with awarding federal funds to a subrecipient. Staff relied on familiarity with the subrecipient rather than formalizing and documenting the required federal oversight steps. Effect: Without a documented risk assessment, timely debarment verification, documented monitoring activities, and required subaward language, the Council cannot fully demonstrate that it mitigated the risk of subrecipient noncompliance. This increases the likelihood that federal requirements may not be met or that noncompliance may go undetected. Questioned Costs: None. Audit Recommendation: The Council should strengthen its subrecipient monitoring processes by: • Developing and implementing a formal risk assessment process for all subrecipients of federal funds. • Performing and documenting suspension/debarment checks prior to issuing any subaward. • Reviewing its subaward requirements to ascertain that they include all the applicable requirements • Establishing monitoring procedures that include: • Tracking and reviewing required financial and programmatic reports for timeliness and completeness. • Obtaining and reviewing the subrecipient’s Single Audit or alternative audit documentation. • Issuing management decisions on findings within 6 months • Documenting follow up on any identified issue Management’s Response: Rogue River Watershed Council’s sub-recipient award in 2025 represents our first (and only) such award to date. While we don’t expect any sub-recipient awards in the near future, we will develop a set of procedures guiding such awards including the steps and the required timing for conducting a risk assessment, suspension/ debarment verification, required monitoring procedures, and the required language under 2 CFR 200, Subpart F. These procedures will be contained within a stand-alone policy for sub-recipient awards.
Federal Program Name: Research and Development Cluster: Uniformed Services University Medical Research Projects Federal Agency: U.S. Department of Defense Federal Assistance Listing Number: 12.750 Criteria or Specific Requirement: Subrecipient Monitoring Condition: During testing of subrecipient monitoring, it was noted that the Organization awarded three awards to subrecipients during the year and did not inform these subrecipients of the federal nature of the award at the time of the subaward. Specifically, the required federal award information was not included in the subaward documentation. Effect: Failure to communicate the federal nature of the award may result in subrecipients not being aware of their responsibilities under federal regulations, which could lead to noncompliance with federal requirements. Questioned Costs: None Context: In accordance with 2 CFR section 200.332(a), pass-through entities are required to clearly identify to the subrecipient the federal award information at the time of the subaward. This includes the federal award identification number, the federal awarding agency, the assistance listing number (ALN), and the amount of federal funds obligated. This information was not communicated to the subrecipients Cause: The Organization did not have adequate procedures in place to ensure that all required federal award information was communicated to subrecipients. Repeat Finding: Yes Recommendation: We recommend that the Organization implement procedures to ensure that all required federal award information is included in subaward agreements and communicated to subrecipients at the time of the award. Views of Responsible Officials and Planned Corrective Action: The Organization agrees with the comment and has revised policies to communicate all required federal award information to subrecipients.
Finding 2025-001 Subrecipient Monitoring (Significant Deficiency) Information on the Federal Programs: Fish and Wildlife Cluster Criteria or Specific Requirement: Under 2 CFR 200.332, pass-through entities are required to evaluate each subrecipient’s risk of noncompliance to determine the appropriate monitoring, monitor subrecipient activities as necessary to ensure compliance with Federal requirements, and verify whether subrecipients that meet the Federal expenditure threshold have obtained a Single Audit. These responsibilities include performing and documenting a subrecipient risk assessment, conducting monitoring activities based on the assessed risk, and obtaining, reviewing, and following up on subrecipient Single Audit reports when applicable. Condition: The Organization does not maintain written policies or procedures that address required subrecipient monitoring activities. The Organization does not perform or document a risk assessment of subrecipients to evaluate their risk of material noncompliance and does not have monitoring procedures that correspond to an assessed level of risk. Additionally, the Organization does not have a policy or consistent practice for determining whether subrecipients are subject to Uniform Guidance Subpart F Single Audit requirements, nor does it obtain or review Single Audit reports from subrecipients that meet the required threshold. Cause: This condition exists because the Organization has not established formal internal controls or written procedures to ensure compliance with all Federal requirements related to subrecipient monitoring. Effect or Potential Effect: As a result, the Organization is not fully compliant with the requirements of 2 CFR 200.332, and there is an increased risk that subrecipient noncompliance may occur and remain undetected. The absence of appropriate risk assessment and monitoring procedures increases the likelihood that programmatic or financial issues at the subrecipient level could go unidentified. Failure to obtain and review required Single Audit reports also increases the risk that audit findings, questioned costs, or other compliance concerns may not be addressed by the Organization in a timely manner. Although no questioned costs were identified during our audit, the control deficiencies described above increase the risk of future questioned costs. Questioned Costs: N/A. Context: This finding was noted during our review of the Organization’s subrecipient monitoring practices and reflects a systemic lack of documented policies and procedures governing the required elements of risk assessment, monitoring, and Single Audit verification. Identification as a Repeat Finding, if Applicable: No. Recommendation: We recommend that the Organization develop and implement comprehensive written subrecipient monitoring policies and procedures that align with 2 CFR 200.332. These procedures should include conducting and documenting a risk assessment for each subrecipient, establishing monitoring activities that are responsive to the level of assessed risk, and implementing a process to determine whether subrecipients are required to obtain a Single Audit and to obtain, review, and follow up on those audit reports as necessary. Establishing these controls will help ensure compliance with Federal requirements and reduce the risk of undetected noncompliance at the subrecipient level.
Finding number: 2025-003 Significant Deficiency – Lack of Internal Control Over Compliance with Subrecipient Monitoring Policy Assistance Listing Number 21.027 (Contract # 902060-23133) Criteria: Pursuant to CFR section 200.332(b), pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: The Unity Council did not perform a risk assessment of subrecipients. This is a repeat finding. Cause: The Organization does not have a formally documented policy for performing a risk assessment over subrecipients. Effect or potential effect: A risk assessment for purposes of determining the appropriate subrecipient monitoring was not performed. Recommendation: Management should develop a risk assessment policy to evaluate the risk profile of each subrecipient. Factors included during the evaluation can include the subrecipient's prior experience with the same or similar subawards, results of previous audits, whether the subrecipient has new personnel or new or substantially changed systems, and the extent and results of federal awarding agency monitoring. View of responsible officials: Management is in agreement with the finding, however the contract ended during 2025 and was not renewed. The Organization has no other subrecipients.
Subrecipient Monitoring – Risk Assessment (Noncompliance) and significant deficiency in Internal Control Finding 2025-002 Identification of the Federal Program: 93.600 – Head Start Cluster, 93.387 – National and State Tobacco Control Program, and 93.872 – Tribal Maternal, Infant, and Early Childhood Home Visit Criteria: According to 2 CFR § 200.332, a pass-through entity must evaluate each subrecipient's fraud risk and risk of noncompliance as a form of subrecipient monitoring. In doing so, a pass-through entity must review financial reports, including their financial audits, ensure that the subrecipient takes corrective action on all significant developments affecting the subaward, issue a management decision on any audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through and resolve audit findings specifically related to the subaward. If a finding rises to a certain level, the pass-through should consider taking action against noncompliant subrecipients. Condition: The organization does not have a formal risk assessment process in place. As of the date of fieldwork, audit reports of member tribes receiving subrecipient payments were not all received and therefore, were not reviewed to perform a proper risk assessment. We additionally noted that a quarterly report was not submitted as required per the agreement and funds were still distributed. Cause: Management's unfamiliarity with 2 CFR § 200.332 requirements and overall relationship with the Tribes. Effect: Risk assessment is significant to performing sufficient subrecipient monitoring. The structure of the organization being governed by the chairs of each Tribe and created to obtain grants to further support the Tribes creates a level of trust amongst the Tribes and the Organization; however, this does not eliminate the need to perform a risk assessment and ensure that the individual Tribes are in compliance at a Federal level. Questioned Costs: $0 Repeat Finding: No Recommendation: We recommend that management and program managers familiarize themselves with the requirements of 2 CFR § 200.332 and create a formal risk assessment process. We also recommend that Tribes are held accountable for not submitting a timely audit (i.e. withholding funds until provided). Management Response: Management agrees with the finding. The Council will work on implementing an efficient, yet effective risk assessment process for all subrecipients.
Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Special Education – Grants for Infants and Families Temporary Assistance for Needy Families (TANF) Block Grants for Prevention and Treatment of Substance Abuse ALN: 84.181 93.558 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Special Education – Grants for Infants and Families H181A200171, H181A210171, H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024, July 1, 2024 – September 30, 2025, July 1, 2025 – September 30, 2026 TANF 2001TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF and 2501TXTANF October 1, 2019 – September 30, 2020, October 1, 2020 – September 30, 2021, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI083054, 1B08TI083478, 1B08I084673, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2019 – September 30, 2021, October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), assistance listings numbers (ALN), and title of the program. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Special Education – Grants for Infants and Families (SEGIF) –The UEI was not included in the base subaward agreement for seven of the eight agreements selected for testing. The last amendment to the original agreement included the UEI number, however, it did not reference the ALN and title of the program. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Temporary Assistance for Needy Families – The ALN and title of the program was not included in four of the seven subaward agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Block Grants for Prevention and Treatment of Substance Abuse –The UEI was not included in one of the 18 agreements selected for testing. The start and end dates for the agreement was September 1, 2020 – August 31, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR §200.332 prior to execution is not at the correct precision level. Effect: Because required subaward information was omitted, HHSC increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing UEI, ALN, and program titles may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: HHSC concurs with the recommendation.
Findings and Questioned Costs Relating to Federal Awards: Finding 2025 001 Timeliness of Subrecipient Monitoring Federal Agency: National Science Foundation U.S. Department of Defense U.S. Department of Health and Human Services Program Name: Research and Development (R&D) Cluster ALN #: 12.910/47.041/47.049/93.213/93.286/93.399/93.837/93.838/93.865 Federal Award Numbers: FA8650 21 2 7119 P00014/EEC 2330040 001/CHE 2221346/ 5R01AT010413 04/5U54EB027049 08/5UG1CA242643 06/ 5UH3HL165065 04/5U01HL146240 07 Revised/ 5U01HL146408 06 Revised Federal Award Year: September 1, 2024 – August 31, 2025 Compliance Requirement: Subrecipient Monitoring Criteria According to 2 CFR 200.332(d), a pass through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subawards, and that the subaward performance goals are achieved. According to 2 CFR 200.332(d)(3) and 2 CFR 200.521, a pass through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure subrecipient single audit reports are reviewed and completed in a timely manner and management decisions are issued within required timeframes. Condition Found The University is required to review the single audit reports received from its subrecipients and issue management decision letters (MDL) within six months of the date of acceptance of the single audit report by the Federal Audit Clearinghouse (FAC). During our testwork over 40 subrecipients, we noted the following: For 3 subrecipients, the University did not issue an MDL in a timely manner. The delay in issuing this MDL was 42 to 167 days beyond the required timeframe. For 11 subrecipients, while the University did review the subrecipient’s single audit report, the review did not occur within the prescribed six month timeframe. The delay in reviewing the subrecipient's single audit reports was 2 to 140 days beyond the required timeframe. Cause The management review controls implemented by the University were not operating at a level of precision to ensure the University completed and documented the monitoring procedures timely primarily due to turnover. The delay occurred during the University’s corrective action period related to a similar finding from the previous year. Possible Asserted Effect Failure to complete and perform reviews of subrecipient single audit reports and issue MDLs in a timely manner may result in subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Questioned Costs None Repeat Finding A similar finding was reported in the prior year audit as finding 2024 001. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Recommendation We recommend the University establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Views of University Officials The University agrees with this finding. Delays occurred during the corrective action period associated with the prior year findings. The University has implemented additional monitoring and tracking procedures indented to strengthen the timeliness of subrecipient reviews and management decision issuance going forward
Item: 2025-002 Assistance Listing Number: 17.280 Program: WIOA Dislocated Worker National Reserve Demonstration Grants Federal Agency: U.S. Department of Labor Pass-Through Agencies: n/a Contract/Pass-Through Grantor Identifying Number: 23A60YP000003 Award Year: September 30, 2023 to September 30, 2026 Compliance Requirement: Subrecipient Monitoring Criteria: A Pass-Through Entity (PTE) is required to monitor the activities of subrecipients as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: (a) reviewing financial and programmatic (performance and special reports) required by the PTE, (b) following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means, and (c) issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR 200.521. Condition: The Foundation did not complete the required subrecipient monitoring related to review of subrecipient Single Audits and financial statements. Specifically, we noted no evidence that the Foundation verified whether certain subrecipients met the Single Audit threshold under 2 CFR 200.501 or obtained the subrecipients’ Single Audit reporting packages from the Federal Audit Clearinghouse. Additionally, the Foundation did not obtain or document a review of the subrecipients’ audited financial statements (or other financial information) to inform the subrecipient risk assessment under 2 CFR 200.332(b). Questioned Costs: n/a Context: Our testing included the Foundation’s two subrecipients with subawards totaling $225,335 during the audit period. For each subrecipient, we noted that the Foundation did not complete the required subrecipient monitoring related to review of subrecipient Single Audits and financial statements. Specifically, we noted no evidence that the Foundation verified whether certain subrecipients met the Single Audit threshold under 2 CFR 200.501 or obtained their Single Audit reporting packages from the Federal Audit Clearinghouse. Additionally, the Foundation did not obtain or document a review of the subrecipients’ audited financial statements (or other financial information) to inform the subrecipient risk assessment under 2 CFR 200.332(b). Effect: The Foundation is not in compliance with certain subrecipient monitoring requirements. This is deemed to be a material weakness in internal control over compliance. Cause: The Foundation did not have sufficient internal controls over subrecipient monitoring. Specific contributing factors included: (a) lack of formal, documented procedures assigning responsibility for obtaining and reviewing subrecipient single audit reports and/or reviewing financial statements, and (b) lack of formal training on Uniform Guidance subrecipient monitoring requirements. Identification as a Repeat Finding: Not a repeat finding. Recommendation: For the current audit period, we recommend the Foundation obtain missing Single Audit reports and financial statements, complete and document the required reviews, update subrecipient risk ratings, and perform any necessary follow-up or management decisions. Additionally, we recommend the Foundation establish formal written procedures to comply with 2 CFR 200.332(b), (d), and (f), 2 CFR 200.501, and 2 CFR 200.521, including clear steps and timelines for verifying Single Audit applicability, obtaining and reviewing Single Audit reports, and issuing management decisions when applicable. Additionally, for subrecipients not subject to the Single Audit, the Foundation should obtain annual audited financial statements (or other appropriate financial information) and performing a documented financial review to inform the risk assessment. Lastly, the Foundation should provide periodic training to finance and program staff on subrecipient monitoring requirements under the Uniform Guidance. Views of Responsible Officials: Management of the Foundation concurs with the finding. See Corrective Action Plan.
Assistance Listing, Federal Agency, and Program Name - 20.507, Department of Transportation, Federal Transit Cluster Federal Award Identification Number and Year - MI 2022-032, MI 2022-048, and MI 2023-027 Pass through Entity - N/A Finding Type - Significant deficiency and material noncompliance with laws and regulations Repeat Finding - No Criteria - Per the Uniform Guidance at 2 CFR 200.332, the pass through entity (SMART) must monitor the activities of a subrecipient as necessary to ensure that the subawards comply with federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition - The Authority did not provide sufficient evidence that there was adequate monitoring of subrecipients. Questioned Costs - None If questioned costs are not determinable, description of why known questioned costs were undetermined or otherwise could not be reported - Not applicable Identification of How Questioned Costs Were Computed - Not applicable Context - It was identified in the 2025 triennial review that the Authority's procedures and documentation of subrecipient oversight was not adequate. The Authority had two subrecipients during fiscal year 2025, and one of the subrecipients was not adequately monitored based on the funding received. Cause and Effect - The Authority did not provide sufficient evidence for adequate monitoring of subrecipients during the triennial review. Recommendation - We recommend the Authority strengthen subrecipient procedures and maintain evidence that these procedures were performed according to schedule. Views of Responsible Officials and Corrective Action Plan - The Authority is in agreement with this finding. The Authority has reviewed and corrected procedures related to monitoring subrecipients.
Finding 2025 - 001 Lack of Subrecipient Monitoring Procedures – Subrecipient Risk Assessments Federal Agencies: U.S. Department of State and U.S. Agency for International Development Federal Programs: Bureau of Population, Refugees and Migration Overseas Refugee Assistance Programs East Asia; Foreign Assistance for Programs Overseas Assistance Listing Numbers:19.523 and 98.001 Pass-through Entities: JSI Research & Training Institute, Inc. and RTI International Award Identification Number and Year: SPRMCO24CA0083, 2024; 7200AA22CA00011, 2022 and 72066923CA00003, 2023 Criteria or Specific Requirement: According to 2 CFR § 200.332(c), pass-through entities are required to: “Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring.” This risk assessment must consider factors such as the subrecipient’s prior experience with similar awards, results of previous audits, new personnel or systems, and the extent of Federal monitoring. Condition: BRAC USA did not adequately document the results of it's risk assessment procedures of its subrecipients prior to issuing subawards, as required by 2 CFR § 200.332(c). During our review of two subawards issued during the audit period, we noted that management did not formally document any evaluation of subrecipient risk related to program compliance, financial stability, or internal controls. Cause: The entity had not developed or implemented formal procedures to adequately document subrecipient risk prior to making subawards. Management was not aware of the documentation requirement or had not prioritized its implementation. Effect or Potential Effect: Without documenting subrecipient risk assessments, BRAC USA cannot ensure that the level of subrecipient monitoring is appropriate to mitigate risks of noncompliance or misuse of Federal funds. This increases the likelihood of unallowable costs, noncompliance with Federal regulations, and potential questioned costs. Questioned Costs: Costs associated with qualitative monitoring measures are not identifiable. Context: During our audit, we examined subawards for two subgrantees for which total expenditures aggregated $1,683,098 (approximately 67% of the total Federal expenditures passed through to subrecipients). Identification as a Repeat Finding, if applicable: Not a repeat findingRecommendation: The entity should establish and implement written procedures to perform and document subrecipient risk assessments prior to awarding Federal funds. The procedures should include standardized criteria—such as prior audit results, experience with similar programs, financial stability, and management capacity—to determine risk levels and guide monitoring activities.
2025-003 Lack of Formal Subrecipient Monitoring Program Name/Assistance Listing Number: 93.788 Opioid STR Federal Agency: Department of Health and Human Services Type of Finding: Significant Deficiency Compliance Requirement: Subrecipient Monitoring Criteria: According to 2 CFR §200.332 (Requirements for Pass-Through Entities), a pass-through entity must monitor the activities of subrecipients as necessary to ensure that federal funds are used for authorized purposes and in compliance with applicable statutes, regulations, and terms and conditions of the Federal award. Required monitoring includes, but is not limited to, the following: a. Reviewing financial and programmatic reports; b. Performing risk assessments of subrecipients; c. Following up on deficiencies identified through audits or reviews; and d. Ensuring subrecipients have required audits under 2 CFR §200.501. Lack of documented subrecipient monitoring constitutes noncompliance with Uniform Guidance. Condition: During our walkthrough and review of the Organization’s grant management processes, we noted that the Organization does not have formal subrecipient monitoring policies or procedures in place. While a monitoring memo exists, it documents only an informal process and does not provide structured oversight. Specifically: - No risk assessments, monitoring checklists, or follow-up documentation were maintained. - There is no formalized, structured process or standard for overseeing subrecipient activities. - Required monitoring under 2 CFR §200.332 could not be performed. Cause of Condition: Management has not developed formal policies and procedures for subrecipient monitoring or consistent documentation standards. Potential Effect of Condition: Noncompliance: Failure to monitor subrecipients increases the risk of noncompliance with Uniform Guidance requirements. Questioned Costs: Federal program expenditures passed through to subrecipients may become subject to questioned costs if insufficient oversight results in unallowable or unsupported charges. Financial & Operational Risk: The Organization may be exposed to reputational or financial consequences, including funding restrictions, if the lack of monitoring persists. Questioned Cost: Not quantifiable. Recommendation: We recommend the Organization develop and implement formal policies and procedures for subrecipient monitoring, including: a. Conducting and documenting subrecipient risk assessments; b. Establishing structured monitoring procedures, such as periodic reviews, report evaluations, and follow-ups; c. Maintaining written documentation of all monitoring activities; and d. Implementing policies to ensure consistent oversight of subrecipient performance and compliance. Description of the Nature and Extent of Issues Reported: The Organization did not perform or document any formal subrecipient monitoring activities during the fiscal year. This constitutes noncompliance with 2 CFR §200.332. Management Response: Management concurred with the finding. In the future, the organization will require midyear and year-end impact reports from each grant subrecipient.
Subrecipient Monitoring Departments of Education Passed through Minnesota Department of Education Federal Financial Assistance Listing 84.027/84.173 Special Education Cluster Condition: During our audit, we found that RAED did not have proper subrecipient monitoring documentation related to approvals and communication of subaward terms and conditions. Criteria: 2 CFR section 200.332, Requirements for pass-through entities, requires RAED to communicate subaward terms and conditions with subrecipient and to monitor the subawards for authorized purposes in compliance with Federal statutes, regulation and the terms and conditions. Cause: Communication to subrecipients about terms and conditions of the subaward was not sent out during the fiscal year. It was also noted that there was a missed approval of a reimbursement request during staff turnover. Effect: RAED is not incompliance with Federal Award Programs. Recommendation: We recommend RAED review their procedures in place to determine if any improvements can be made to ensure compliance with subrecipient monitoring. Management Response: There is no disagreement with the audit finding.
Finding 2025-002: Subrecipient Monitoring Criteria: The Uniform Guidance (2 CFR §200.332) requires a non-Federal entity to monitor the activities of its subrecipients as necessary to ensure that Federal awards are used for authorized purposes in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Specifically, the Sponsoring Organization is required to perform specific monitoring activities, including site visits, for its CACFP subrecipients (centers/homes). To ensure that these required monitoring activities are occurring timely and correctly, the Sponsoring Organization's internal controls include a requirement for monthly meetings between the Program Manager and the Monitoring Specialist to review the status of subrecipient monitoring. Condition: During the review of internal controls related to subrecipient monitoring, it was noted that the required monthly meetings between the Program Manager and the Monitoring Specialist were not consistently performed throughout the fiscal year. Specifically, for the 12-month period tested, the required monthly reviews were not documented for 3 out of 12 months. Cause: The lapse in the required monthly reviews was attributed to staff turnover in the program office and competing priorities that diverted staff time away from this control activity. Effect: The lack of consistent management oversight through the required monthly meetings increases the risk that mandatory subrecipient monitoring activities (e.g., required site visits, review of subrecipient documentation) could be delayed, missed, or performed inadequately. This could result in non-compliance by the subrecipients going undetected, potentially leading to inaccurate claims and funds being used for unauthorized purposes. Questioned Costs: None noted. Context: This is the first year this finding has been reported. The internal control deficiency appears to be a breakdown in the execution of the established procedure rather than an absence of a control. Repeat Finding: No. This is the first time this specific finding has been identified. Recommendation: We recommend that management reinforce the importance of this control and implement a documented process to ensure that the monthly meetings between the Program Manager and the Monitoring Specialist occur consistently. This should include establishing a recurring meeting schedule and requiring documentation (e.g., signed meeting minutes, checklist) that demonstrates the review of monitoring status took place each month, even during periods of staff turnover or high-priority competing demands.
Finding 2025-003: Subrecipient Monitoring Criteria: The Uniform Guidance (2 CFR §200.332) requires a non-Federal entity to monitor the activities of its subrecipients as necessary to ensure that Federal awards are used for authorized purposes in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Furthermore, the Organization's policy and/or CACFP regulations governing the Sponsoring Organization require an initial on-site review of each new center or Family Child Care (FCC) provider within the first 28 calendar days of program operation. This is a critical component of initial subrecipient monitoring to ensure program integrity and compliance with Federal requirements. Condition: The Sponsoring Organization did not consistently perform the required initial on-site review for new subrecipients (centers and FCC providers) within the mandatory 28-day timeframe. A sample of 40 new centers/FCC providers was selected for testing. Four (4) of the 40 subrecipients (10%) did not have their initial on-site review completed within the first 28 days of operation. The delays in conducting the initial reviews ranged from 6 to 23 days past the required 28-day deadline. Cause: The cause appears to be an inadequate internal control or process to ensure initial review scheduling and completion are prioritized and managed to meet the 28-day deadline, potentially due to competing demands or staffing limitations. Effect: Failure to conduct initial on-site reviews within the required timeframe weakens the Sponsoring Organization's internal controls over subrecipient monitoring and oversight. Timely initial reviews are essential for early identification and correction of compliance issues, proper training, and ensuring new centers/FDCH providers operate in accordance with Federal CACFP requirements from the outset. Questioned Costs: None noted. Context: This is the first time this issue has been noted as a finding. The Sponsoring Organization performed the required reviews; however, they were completed after the regulatory deadline. Repeat Finding: No. This is the first time this specific finding has been identified. Recommendation: The Sponsoring Organization should strengthen its internal controls and monitoring procedures to ensure that all new centers and FCC providers receive the required initial on-site review within the 28-day mandatory timeframe. This should include: 1. Establishing a formal process with documented timeframes for assigning and completing initial reviews immediately upon a new site's approval. 2. Implementing a system to track and alert monitoring staff of the 28-day deadline for each new subrecipient. 3. Providing targeted training to monitoring staff to emphasize the importance of timely initial reviews and the associated regulatory deadlines.
Finding: 2025-002 Subrecipient Monitoring (Significant Deficiency) Federal Agency(ies): United States Department of Agriculture Federal Program(s): Partnerships for Climate-Smart Commodities Assistance Listing Number(s): 10.937 Pass-through Entity (if applicable): N/A Award Identification Number and Year: NR233A750004G045 (2023) Criteria or Specific Requirement: Per 2 CFR 200.332 Requirements for pass-through entities: Pass-through entities must clearly identify to subrecipients the award information, including the Assistance Listing number, subrecipient’s UEI, Federal award identification number, and Federal award project title (§200.332(a)(1)). Pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate subrecipient monitoring (§200.332(b)). Pass-through entities must monitor the activities of subrecipients as necessary to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward (§200.332(d)). Condition: During our testing of subrecipient monitoring, we noted several deficiencies: 1. Subaward agreements were structured more like subcontracts rather than subrecipient agreements and did not include all elements required under 2 CFR 200.332(a), such as the subrecipient’s UEI and Assistance Listing number. 2. Subrecipients were required to submit periodic invoices for reimbursement instead of financial reports detailing costs incurred by budget line item, cumulative expenditures, cash receipts, and cash balances. 3. Pre-award risk assessments were completed; however, the assessments were undated, preventing the audit team from verifying that they occurred prior to subaward execution. Additionally, the monitoring procedures described in policy were not clearly linked to assessed risk levels, and in certain instances, subrecipients with no prior Federal grant management experience were assigned a “low risk” classification. Cause: These conditions occurred due to a lack of formalized procedures to align subrecipient agreements, reporting requirements, and monitoring activities with the specific requirements of 2 CFR 200.332. Management relied on existing subcontract templates and internal policies that were not fully updated to reflect Uniform Guidance requirements. Effect or Potential Effect: Failure to properly structure subaward agreements, and obtain adequate financial reporting, increases the risk that subrecipients may not comply with Federal statutes and regulations. Questioned Costs: N/A Context: We tested a statistically valid sample of subawards charged to Federal awards. The deficiencies noted were consistent across the sample population, indicating a systemic issue rather than isolated exceptions. Identification as a Repeat Finding, if Applicable: Yes, repeat of Finding 2024-002Recommendation: We recommend that management: Update subaward agreement templates to include all elements required under 2 CFR 200.332(a). Require subrecipients to submit periodic financial reports by budget line item, cumulative expenditures, cash receipts, and cash balances, rather than invoices alone. Revise pre-award risk assessment procedures to include dating and ensure that results are documented prior to subaward execution. Strengthen policies to ensure monitoring procedures are explicitly linked to risk assessment results, with higher levels of oversight required for subrecipients new to Federal grant management.
Findings and Questioned Costs Relating to Federal Awards: 2025-001 Compliance Finding: Subrecipient Monitoring-Audit Verification. Federal Agengy: Department of the Treasury. Pass-through Entity: SC Rural Infrastructure Authority. Federal Program: Coronavirus State and Local Fiscal Recovery Funds(CSLFRF)-Water Capacity Improvments. Assistance Listing Number: 21.027. Criteria. In accordance with 2 CFR 200.332(g) a pass-through entity must verify that a subrecipient is audited as required by subpart F. Subpart F: 200.501 Audit Requirements. (a) Audit required. A non-Federal entity that expends $1,000,000 ($750,000 prior to the 2024 uniform Guidance (UG) revisions) or more during the non-Federal enity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. Condition. Cherokee County did not adequately verify that the subrecipient obtained the required single audit or program specific audit in accordance with 2 CFR 200.332. Although Cherokee County was aware that the subrecipient would be subject to audit requirements based on federal expenditures, Cherokee County did not obtain or otherwise confirm receipt of the required audit report by the applicable submission deadline of September 30, 2025. Upon further inquiry it was determined that the subrecipient did not have a single audit or program-specific audit by September 30, 2025. Cause. The County did not perform sufficient follow-up procedures to confirm subrecipient compliance with single audit requirements after being notified that the subrecipient would be subject to audit for the year ended December 31, 2024. Effect. Failure to verify receipt of the required audit prevented Cherokee County from complying with their policies and procedures and with federal regulation in a timely manner. Recommendation. We recommend that Cherokee County enhance its subrecipient monitoring procedures to include documented follow-up and verification that subrecipients subject to single audit requirements submit the required audit reports within the applicable timeframes, in accordance with 2 CFR 200.332.
Federal Program: Temporary Assistance for Needy Families (TANF) (93.558). Criteria: 2 CFR 200.332(d) requires pass-through entities to monitor the activities of subrecipients to ensure compliance with federal statutes, regulations, and the terms and conditions of the subaward. Required monitoring activities include reviewing financial and performance reports, following up on deficiencies, and ensuring timely corrective action. Condition: The Council did not perform required monitoring procedures for subrecipients as required by Uniform Guidance: Cause: The Council lacked formal procedures and controls for tracking and reviewing subrecipient audit reports and for documenting follow-up on identified deficiencies. Effect: There is an increased risk that subrecipients may not comply with federal requirements, which could result in unallowable costs, questioned costs, or other noncompliance with federal statutes and regulations. Questioned Costs: None. Context: This finding was noted in 3 out of 4 subrecipients for the fiscal year ended June 30, 2025 with a total of $124,302 paid to subrecipients. Repeat Finding: No. Recommendation: We recommend the client implement and document formal procedures to ensure all required subrecipient monitoring activities are performed in accordance with Uniform Guidance, including obtaining and reviewing subrecipient audit reports and following up on any identified deficiencies. Views of Responsible Officials: Management concurs with the finding and will implement corrective action.
Finding Reference Number: 2025-001 Federal Program: CFDA 93.959– Block Grants for Prevention and Treatment of Substance Abuse Federal Agency: U.S. Department of Health and Human Services Pass-Through Entity: Lutheran Service Florida, Inc. Award Year: FY 2025 Criteria: Per 2 CFR §200.332(d), pass-through entities must monitor the activities of subrecipients to ensure that federal awards are used for authorized purposes and in compliance with laws, regulations, and the provisions of the subaward. Monitoring includes reviewing performance and financial reports required by the subaward agreement. Condition: The pass-through entity conducted appropriate monitoring activities for the subrecipient Bradford Community Coalition, Inc., including communication and oversight consistent with federal requirements. However, the subrecipient did not submit the required monitoring report by the established deadline. As of the audit report date, the report remained outstanding. Cause: While the pass-through entity fulfilled its monitoring responsibilities, the subrecipient failed to comply with reporting requirements in a timely manner. Effect: The absence of the monitoring report limits the pass-through entity’s ability to fully verify that the $39,406 in federal funds was used in accordance with applicable regulations. This may result in questioned costs due to insufficient documentation. Questioned Costs: $39,406 Recommendation: We recommend the pass-through entity continue its monitoring efforts and implement additional follow up procedures to ensure timely receipt of required reports. The entity should also consider revising subaward agreements to include stronger enforcement mechanisms for noncompliance. Views of Responsible Officials: The organization monitored the subrecipient in accordance with federal guidelines and has documented its oversight activities. We are working with the subrecipient to obtain the overdue report and have updated our procedures to escalate follow-up actions when reports are delayed.
U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-014 Condition: For 2 out of 2 selections, the unique identifier number and federal award identification number were not included in the grant agreement. For 2 out 2 selections, evidence that the prior year Single Audit Report was reviewed was not provided. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Pursuant to 31 USC 7502(f)(2) (Single Audit Act Amendments of 1996 (Pub. L. No. 104-156)), 2 CFR sections 200.330, .331, and .501(h), a pass-through entity must identify the award and applicable requirements, evaluate risk, monitor, and ensure accountability of subrecipients. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (b) Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; and (2) The results of previous audits including whether or not the subrecipient receives a Single Audit. (f) Verify that every subrecipient is audited as required by 2 CFR § 200.331 when it is expected that the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Cause: The Mayor’s Office of Homeless Services (MOHS) did not maintain adequate documentation of the requirements included in Uniform Guidance for subrecipient monitoring. Effect: The subrecipient could not be in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend that MOHS establish and implement controls to ensure grant agreements include the unique identifier number and federal award identification number. We also recommend a process to ensure that the single audit of subrecipients are reviewed timely. Additionally, we recommend that MOHS provides training on the Uniform Guidance requirements related to subrecipient monitoring. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.
U.S. Department of Labor (DOL) AL No. 17.258, 17.259, 17.278 Workforce Innovation and Opportunity Act (WIOA) Cluster Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: No Condition: For 2 out of 2 selections, the unique identifier number on the notice of award did not agree with the subrecipient's active registration UEI on SAM.gov. For 2 out of 2 selections, management was unable to provide evidence that subrecipient monitoring was performed to ensure compliance with accounting requirements. For 2 out of 2 selections, evidence that the prior year Single Audit Report was reviewed was not provided. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (b) Evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. According to AM 413-60, Grant Documentation, Grant Manager/Program Manager/Director Conducts ongoing monitoring and control of all reimbursement receipts and deposits until grant ends; as well as all program and sub-recipient (when applicable) documentation, to include: (1) program documentation; (2) timesheets; (3) deliverables; (4) activities; (5) vendor payments; (6) program data/charts/numbers; and (7) financial and compliance report. According to AM 413-61, Grant Management Financial Reporting, Grant Manager/Program Manager/Director maintains all documentation, either electronic or hard copy, for all federally funded grants for the term of the grant for a minimum of seven years for review and audit by the granting agency or its designee. Cause: The Mayor’s Office of Employment Development (MOED) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: MOED may not be in compliance with the subrecipient monitoring requirements of its grants. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.
U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-022 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 1 out of 1 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR 200.303: Internal Control, the non-Federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: The Baltimore County Department of Health (BCHD) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.
U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-025 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 5 out of 6 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR 200.303: Internal Control, the non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: The Baltimore County Department of Health (BCHD) did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.
U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Significant Deficiency in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-028 Condition: The unique entity identifier (UEI) was not included in the grant agreements for 2 out of 5 subrecipient grant agreement selected for testing. Criteria: In accordance with 2 CFR §200.303: the non-federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. Cause: BCHD did not have proper controls in place to ensure the subrecipient monitoring requirements of the grant were met. Effect: BCHD may not be in compliance with the subrecipient monitoring requirements of the grant. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.
U.S. Department of Treasury AL No. 21.027 American Rescue Plan Act Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-015 Condition: There was no evidence that the City verified whether the subrecipient was suspended and/or debarred from receiving federal funds for 3 out of 40 subrecipients selected for testing. The City did not have current subrecipient grant agreements for 3 out of 40 subrecipients selected for testing. The unique entity identifier (UEI) was not included in the grant agreements for 3 out of 40 subrecipient grant agreements selected for testing. The Federal Award Identification Number (FAIN) was not included in the grant agreements for 8 out of 40 subrecipient grant agreements selected for testing. The UEI was incorrect in the grant agreement for 1 out of 40 subrecipient grant agreements selected for testing. Criteria: In accordance with 2 CFR §200.303: The non-federal entity must: (a) Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. In accordance with 2 CFR §25.300: (a) A recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Subrecipients are not required to complete full SAM registration to obtain a unique entity identifier; and (b) A recipient must notify any potential subrecipients that the recipient cannot make a subaward unless the subrecipient has obtained a unique entity identifier as described in paragraph (a) of this section. According to 2 CFR §200.332, all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the federal award identification including the subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), identification of whether the award is R&D and indirect cost rate for the federal award. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. According to AM 413-61, Grant Management Financial Reporting, Grant Manager/Program Manager/Director maintains all documentation, either electronic or hard copy, for all federally funded grants for the term of the grant for a minimum of seven years for review and audit by the granting agency or its designee. Cause: The City did not maintain adequate documentation of the requirements included in Uniform Guidance for subrecipient monitoring. Effect: The subrecipient could not be in compliance with Uniform Guidance. Questioned Costs: Unknown. Recommendation: We recommend the City establish and implement controls to maintain compliance with subrecipient monitoring requirements. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor’s Conclusion: Finding remains as stated.
Finding 2025.003 - Subrecipient Monitoring - Material Weakness Name of Federal Agency: U.S. Department of Health and Human Services Federal Program Name and Assistance Listing Number: Head Start Cluster, 93.600 Federal Award Identification Number and Year: 01CH011268-05-01 (2024), 01CH012890-01-01 (2024), 01CH011268-05-03 (2024) Name of Pass-through Entity (if applicable): N/A Criteria Per 2 CFR 200.332 (Requirements for pass-through entities) a pass through entity must, among other things, evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward and monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition CLC did not properly monitor its subrecipient in accordance with Uniform Guidance requirements. The agreement with the subrecipient referred to outdated polices that were replaced by the Uniform Guidance (Circulars A-87, A-110, A-133) and did not include all required elements which included, but is not limited, to the Assistance Listing Number, Unique Identifying Number. A review was not performed of the use of program funds or the subrecipient's audited financial statements and Uniform Guidance report. Cause The Financial Policies and Procedures Manual was not followed. The manual also needs to be updated to include the updated requirements of the Uniform Guidance and require documentation of review of compliance with requirements. Effect or Potential Effect Failure to perform required risk assessments and to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Questioned Costs None Context During our testing, we noted CLC did not perform subrecipient monitoring procedures over subrecipients with respect to the Head Start Cluster Program during the year ended June 30, 2025. Amounts passed through to subrecipients totaled $284,791 for the year ended June 30, 2025. Identification as a Repeat Finding This is not a repeat finding. Recommendation Management should review the Uniform Guidance requirements for subrecipient monitoring and update their policy manual as appropriate. We recommend CLC develop and implement a standardized checklist that outlines all subrecipient monitoring compliance requirements. The checklist should clearly identify the individual responsible for implementing each requirement and the individual responsible for reviewing compliance, along with documentation of that review. Views of Responsible Officials Children’s Learning Centers of Fairfield County, Inc. concurs with this finding. Management will update its Financial Policies and Procedures Manual and subaward templates to align with current Uniform Guidance requirements, including all required subaward elements (such as Assistance Listing Number, UEI, award identification, and applicable compliance requirements). CLC will implement a standardized subrecipient monitoring checklist covering risk assessment, review of invoices and programmatic reports, verification of allowable costs, confirmation and review of subrecipient audit requirements and Uniform Guidance reports (as applicable), and documentation of management review. Monitoring will be documented and reviewed by senior management on at least an annual basis and more frequently based on risk.
FINDING 2025-003 Subject: Teacher and School Leader Incentive Grants – Subrecipient Monitoring Federal Agency: Department of Education Federal Program: Teacher and School Leader Incentive Grants Assistance Listings Number: 84.374 Federal Award Numbers and Years (or Other Identifying Numbers): Year 2-3, Year 3-4 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Modified Opinion Condition and Context The School Corporation had not properly designed or implemented a system of internal controls, which would include appropriate segregation of duties, that would likely be effective in preventing, or detecting and correcting, material noncompliance related to the Teacher and School Leader Incentive Grants (TSL) funds passed through to subrecipients. The School Corporation received and passed through to subrecipients $6,143,393 of TSL funds. The School Corporation is to clearly identify the award and applicable requirements to the subrecipients, evaluate the risk of noncompliance related to the subrecipients to determine appropriate monitoring of the subaward, and monitor the activities of the subrecipients to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. The School Corporation did not enter into an agreement with the subrecipients. As such, there is no agreement between the School Corporation and the subrecipients that clearly identifies the award as a subaward or includes all the required data elements. In addition, the School Corporation did not have any policies or procedures in place to evaluate the subrecipients' risk of noncompliance or to monitor the activity of the subrecipients. Per inquiry of the School Corporation, it was determined an evaluation of the risk of noncompliance for the subrecipients was not completed, nor did the subrecipients' files support any such evaluation. The lack of internal controls and noncompliance were systemic issues throughout the audit period. INDIANA STATE BOARD OF ACCOUNTS 19 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states: "All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the passthrough entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; INDIANA STATE BOARD OF ACCOUNTS 20 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; (4) (i) An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the pass-through entity must determine the appropriate rate in collaboration with the subrecipient, which is either: (A) The negotiated indirect cost rate between the pass-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass-through entity is not required to collect information justifying this rate, but may elect to do so; (B) The de minimis indirect cost rate. (ii) The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). (5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient's records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and (6) Appropriate terms and conditions concerning closeout of the subaward. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; INDIANA STATE BOARD OF ACCOUNTS 21 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. INDIANA STATE BOARD OF ACCOUNTS 22 METROPOLITAN SCHOOL DISTRICT OF DECATUR TOWNSHIP SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 of this part and in program regulations." Cause The School Corporation's management was not aware of the requirements for subrecipient and subaward monitoring compliance. Thus, the School Corporation had not implemented its system of internal controls, which would include appropriate segregation of duties that would likely be effective in preventing, or detecting and correcting, noncompliance related to the Subrecipient Monitoring compliance requirement. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the School Corporation establish a proper system of internal controls, including segregation of duties, to evaluate the subrecipients' risk of noncompliance and adequately monitor the subrecipients. Additionally, policies and procedures should be implemented to ensure appropriate reviews, approvals, and oversight are taking place, as needed, to evaluate and monitor its subrecipients. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
Condition: The City entered into a written agreement with a subrecipient; however, the agreement did not include language requiring the subrecipient to compliance with the Uniform Guidance. As a result, the subrecipient was not formally notified of its responsibility to adhere to federal administrative, cost, and audit requirements. Criteria: 2 CFR §200.332(a) requires pass-through entities to ensure that subaward agreements include all required federal award information and clearly identify applicable federal statutes, regulations, and terms and conditions, including compliance with Uniform Guidance (2 CFR Part 200). Cause: The City had a preexisting agreement with an entity who later became a subrecipient of federal grant pass-through funds. The City did not amend their agreement to include the required components after receiving the grant nor report the funds as federal revenues or expenditures in the City’s financial statements. Effect or Potential Effect: Without a formal subaward agreement, the pass-through entity lacks assurance that the subrecipient understands and complies with applicable federal requirements, increasing the risk of noncompliance, improper use of federal funds, and questioned costs. The subrecipient may also not be aware of their responsibility to report the related federal expenditures on the subrecipient’s schedule of expenditures of federal awards. Questioned Costs: None. Recommendation: We recommend that the City identify all federal expenditures and passthrough awards and notify all subrecipients of their receipt of federal awards by identifying the award granted, specific compliance requirements passed-through and other requirements of 2 CFR 200.332. Management’s Comments Regarding Corrective Actions Planned: Management agrees with the finding. The City had a preexisting agreement with the subrecipient for a project that was already in progress when the federal grant was awarded. The subrecipient had in-depth involvement during the federal grant application process and is aware of specific compliance requirements under the Uniform Guidance (2 CFR Part 200). We will make sure that all future subrecipients of pass-through federal grants are notified in writing of the responsibility to adhere to federal administrative, cost, and audit requirements.
Federal Program - Research and Development Cluster Assistance Listing Numbers - Various Federal Agency - All Research and Development Sponsor Award Number - Various Award Period - Various Criteria or Specific Requirement – Subrecipient Monitoring - Management is responsible for verifying that subrecipients expected to be audited as required by CFR part 200, subpart F, met this requirement. (2 CFR 200.332(g)) Condition - Management reported that subrecipient monitoring procedures as it relates to confirming subrecipients met audit requirements had not been completed during the year. Cause - Turnover of University personnel responsible for subrecipient monitoring. Questioned Costs - There were no questioned costs as a result of this finding. Effect - While management did follow established controls to determine whether subrecipients used the Federal awards for authorized purposes and complied with Federal statutes, regulations and the terms and conditions of the sub award, by not confirming whether subrecipients had received required audits, management may not become aware of subrecipients with audit findings. Context - Management reported that subrecipient monitoring procedures as it relates to confirming subrecipients met audit requirements had not been completed for all ten subrecipients during the year. Identification as a Repeat Finding - No. Recommendation - We recommend management bring subrecipient audit documentation current and complete training with responsible individuals to ensure future compliance.
2025-001 Internal Controls Systems and Compliance Over Subrecipient Monitoring – U.S. Department of Treasury, COVID-19 Coronavirus State and Local Fiscal Recovery Funds, Passed Through the State of Nevada Department of Education Criteria: In accordance with 2 CFR 200.332(a)(1), the auditee must maintain a system of internal control to ensure information related to federal awards is clearly identified to the subrecipient at the time of the subaward and if any data elements change, include the changes in a subsequent subaward modification. Condition: The Organization receives funding for the Nevada Ready! program through the State of Nevada Department of Education. The amount of funding provided by Federal and state sources changes annually as does the Federal program from which the funds are derived. The Organization did not receive clear documentation from their grantor on the source of grant funding and did not clarify with the grantor on these requirements. The Organization then did not identify the correct Federal agency and assistance listing number for the grant awards provided to subrecipients. Context: Sixteen preschool centers received notification of subawards with an incorrect Federal agency and assistance listing number for the Federal funds received. Cause: The design and implementation of internal controls over subrecipient monitoring was not operating effectively. Effect: Not communicating the correct Federal agency and assistance listing number in a subaward to subrecipients could result in the subrecipients not complying with Federal regulations. Repeat Finding: Yes. Prior finding 2024-001. Recommendation: We recommend management design and implement a system of internal controls whereby every subaward that includes Federal funding be clearly identified to the subrecipient as a Federal subaward and include all data elements required to be provided to the subrecipient at the time of the subaward. For any information where the Organization’s grantor has provided unclear or incomplete information, appropriate follow-up with the grantor should be performed. Additionally, if any of the data elements change, those changes should be included in a subsequent subaward modification. Views of Responsible Officials and Planned Corrective Action: We appreciate the identification of this compliance issue and are committed to addressing the finding with a robust corrective action plan. The following steps outline the measures we will take to ensure compliance with federal requirements for subrecipients. 1. Each subaward will be clearly identified as a federal subaward and include all required data elements at the time of issuance. Any subsequent changes will be communicated through a formal subaward modification process. 2. Each required data element will be reviewed and compared to the source data by the preparer and the final signer. If elements are unclear or incomplete, follow-up with the grantor will be performed before the execution of the agreement. If clarity cannot be obtained, the agreements will be executed, noting the area of unclear or incomplete data and that the information will be obtained and updated promptly through a formal subaward modification agreement. 3. In the event subsequent changes occur, these changes will be communicated through a formal subaward modification agreement.
Coronavirus State and Local Fiscal Recovery Funds: Noncompliance over Subrecipient Monitoring Condition: During our testing of subrecipient monitoring requirements, we noted that for all of the subrecipients tested, the Organization did not verify whether or not the subrecipient required and, if so, completed an audit. Criteria: 2 CFR 200.332(g) of the Uniform Guidance requires pass-through entities to verify that subrecipients are audited as required by subpart F of 2 CFR 200. Cause: The exception was due to a breakdown in the Organization’s procedures to ensure that all subrecipient monitoring procedures are in accordance with Uniform Guidance. Effect: There is an increased risk that noncompliance at the subrecipient level could occur and remain undetected by the Organization. Improper subrecipient monitoring procedures can also result in actions taken by oversight agencies which could impact future funding. Context: The population subject to subrecipient monitoring requirements included 69 subrecipients. The sample size of seven subrecipients was determined. Recommendation: We recommend that the Organization implement procedures that include monitoring that subrecipients needing an audit meet the requirement. Views of Responsible Officials: Management agrees with the finding.
Finding No. 2025-001 – Subrecipient Monitoring Deficiencies Repeat Finding: No ALN and Program: 84.002 – Adult Education State Grant Program Award Amount: $1,384,339 Award Number: 09-401-146-125 Award Year: 7/1/2024-6/30/2025 Criteria: 2 CFR 200.332 specifies requirements for monitoring subaward agreements. Section (b) of the guidance lists required elements to be included in subaward agreements, including subrecipient identifying information, information about the original federal award dates and amounts, contact information, and compliance requirements of the award. Section (c) specifies that grantees evaluate each subrecipient's fraud risk and risk of noncompliance with the subaward. Section (e) requires grantees to assess risk and monitor the activities of a subrecipient as necessary to ensure the subrecipient complies with Federal statutes, regulations, and terms and conditions of the subaward. MATC's system of control is required to be designed and implemented in order to ensure compliance of subawards with the applicable compliance requirements. Condition/Context: In testing compliance with the requirements of 2 CFR 200.332, we noted that MATC's internal controls over subrecipient monitoring requirements were not effectively operating during the year ended June 30, 2025. MATC's subaward agreement with Literacy Services of Wisconsin did not contain all the required information included in Section (b). In particular, the agreement was missing the subrecipient's Unique Entity Identification Number (UEI), the Federal and / or State Award Identification Number (FAIN), Federal and / or State Award Date, and the indirect cost rate for the Federal and / or State Award. Additionally, MATC was not able to produce evidence of the required risk assessment process, and resulting monitoring activities deemed necessary to ensure the subgrantee's compliance with Federal Requirements. MATC's review and approval process for this subaward did not prevent, detect, or identify the missing contract information or the lack of documented risk assessments. Monitoring activities were performed; however, without the documented risk assessment, it is unclear whether the activities were sufficient. Cause: MATC has made subawards under the AEFL program for many years, and the same subaward document has been used without amendment. While the agreement was subjected to the required review and approval process internally, the review did not identify the updated requirements for elements of the agreements. Additionally, MATC has historically performed site monitoring and review of financial reports for all of its sub-awardees; however, in 2025 the individual responsible for performing this process retired and a replacement was not found for several months, resulting in a vacancy in the position and lack of available staffing to complete the monitoring documentation and process. Questioned Costs: None Effect: The subaward agreement is not in compliance with Federal sub-award requirements, and an appropriate risk assessment was not documented, which could result in incorrect reporting of the award by the sub-grantee, or potential non-compliance of the sub-awardee. Recommendation: We recommend MATC evaluate its award approval process and implement clear and robust procedures designed to ensure agreements are compared to the most current set of requirements for compliance.
Type of Finding: Subrecipient Monitoring – Noncompliance and Internal Control (Significant Deficiency) Supplemental Nutrition Assistance Program Cluster: State Administration Matching Grants for the Supplemental Nutrition Assistance Program (Assistance Listing #10.561) Federal Agency: U.S. Department of Agriculture Pass-Through Entity: New York State Office of Temporary and Disability Assistance Contract Number: TDA01-C00986GG-3410000 Funding Years: 10/1/2023 - 9/30/2025 Criteria: Per 2 CFR 200.332(g), a pass-through entity must verify that subrecipients expected to be audited by 2 CFR Part 200, Subpart F, met this requirement. Condition/Context: For a non-statistical sample of three subrecipients, during the fiscal year ended June 30, 2025, UWNYC did not verify that subrecipients expected to be audited as required by 2 CFR Part 200, Subpart F, met this requirement. Cause: UWNYC’s internal controls over subrecipient monitoring lacked the requirement to ensure that UWNYC complied with 2 CFR 200.332(g). However, UWNYC requested and obtained the most recent audit report required by 2 CFR Part 200, Subpart F for each of the sampled subrecipients as part of CBIZ CPAs’ Single Audit requests. Effect: UWNYC was noncompliant with the subrecipient monitoring requirement described in 2 CFR 200.332(g). Questioned Costs: None. Identified as a Repeat Finding: No. Recommendation: UWNYC should implement a procedure within its subrecipient monitoring process and internal control to ensure that, each year, program staff verify whether subrecipients are expected to be audited by 2 CFR Part 200, Subpart F. For those subrecipients that expect to be audited by 2 CFR Part 200, Subpart F, program staff should also obtain and review the final audit report. If the final audit report includes any audit findings, including those specifically related to the subaward, UWNYC should consider such audit findings as part of UWNYC’s assessment of the subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Views of Responsible Officials: We acknowledge and accept this finding. To address this gap and prevent recurrence, we will implement a formal annual verification and documentation process requiring program staff to determine audit applicability, obtain and review final Single Audit reports, and incorporate any audit findings into subrecipient risk assessments to inform ongoing monitoring. These procedures will be documented and integrated into UWNYC’s internal controls to ensure future compliance.
Finding 2025-003: Subrecipient Monitoring (Significant Deficiency) Federal Agency: United States Department of Health and Human Services. Federal Program: Unaccompanied Children Program. Assistance Listing Number: 93.676 Pass-through Entity, if applicable: Not applicable. Award Identification Number and Year: All awards and all of 2025 fiscal year. Criteria or Specific Requirement (including Statutory, Regulatory, or Other Citation): Criteria or specific requirement (including statutory, regulatory, or other citation): Per 2 CFR 200.332 Requirements for pass-through entities: Verify that the subrecipient is not excluded or disqualified in accordance with § 180.300. Pass-through entities must evaluate each subrecipient’s risk of noncompliance to determine the appropriate subrecipient monitoring (§200.332(b)). Verify that a subrecipient is audited as required. Condition: During our testing of subrecipient monitoring, we noted several exceptions as follows: No process was in place to verify that subrecipients are suspended or debarred from receiving Federal funds. Pre-award risk assessments were not completed. The monitoring procedures were not linked to assessed risk levels. The audited financial statements of the subrecipients were not received in order to assist in the risk assessment process. Cause: These conditions occurred due to a lack of formalized procedures to align subrecipient agreements, reporting requirements, and monitoring activities with the specific requirements of 2 CFR 200.332. Management relied on existing subcontract templates and internal policies that were not fully updated to reflect Uniform Guidance requirements. Effect or Potential Effect: Failure to properly structure subaward agreements, and obtain adequate financial reporting, increases the risk that subrecipients may not comply with Federal statutes and regulations. Questioned Costs: Costs associated with qualitative monitoring procedures are not identifiable. Context: We tested a statistically valid sample of subawards charged to Federal awards. The deficiencies noted were consistent across the sample population, indicating a systemic issue rather than isolated exceptions. Identification as a Repeat Finding, if applicable: Not a repeat finding. Recommendation: We recommend that management implement processes and procedures as follows: Establish formalized policies and procedures on subrecipient monitoring; Include a screening of subrecipients against the Federal suspended and debarred list as part of the contracting process; Implement pre-award risk assessments that clearly links monitoring procedures to the level of assessed risk; Document the monitoring procedures that occurred throughout the year in accordance with the established policies and procedures and identified risk assessment for each subrecipient.
Finding 2025-004: Federal Funding Accountability and Transparency Act of 2006 (FFATA) Reporting (Significant Deficiency) Federal Agency: United States Department of Health and Human Services. Federal Program: Unaccompanied Children Program. Assistance Listing Number: 93.676 Pass-through Entity, if applicable: Not applicable. Award Identification Number and Year: All awards and all of 2025 fiscal year. Criteria or Specific Requirement (including Statutory, Regulatory, or Other Citation): In accordance with 2 CFR 200.332 and as required by the Federal Funding Accountability and Transparency Act of 2006 (Pub. L. 109–282), as amended by section 6202 of Public Law 110–252, recipients must report information for each subaward of $30,000 or more in Federal funds and executive total compensation, as outlined in Appendix A to 2 CFR Part 170. The information is to be submitted to the FFATA Subaward Reporting System (FSRS) by the end of the month following the month in which the subaward was awarded. Condition: During our review of subrecipient activities, we noted that Everstand was not submitting the required reporting under FFATA regulations. Cause: Internal controls over financial reporting were not operating effectively to ensure reporting under FFATA in a timely manner. Effect or Potential Effect: Failure to submit the required reports by the submission deadline results in noncompliance with the Federal Funding Accountability and Transparency Act of 2006 as outlined in Appendix A to 2 CFR Part 170. Questioned Costs: Costs associated with qualitative reporting requirements are not identifiable. Context: We tested a statistically valid sample of subawards charged to Federal awards. The deficiencies noted were consistent across the sample population, indicating a systemic issue rather than isolated exceptions. Identification as a Repeat Finding, if applicable: Not a repeat finding. Recommendation: We recommend that management strengthen controls over reporting requirements for each Federal award to ensure timely submission of required reports.
Reference Number: 2025-021 Prior Year Finding: 2024-054 Federal Agency: Department of Health and Human Services State Agency: Department of Agriculture Federal Program: Research and Development Cluster Assistance Listing Number: 93.103 Award Number and Year: 5U2FFD007445-04 (7/01/2024 – 06/30/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Agriculture did not include all required information in subaward agreements. Context: One of eight subawards selected for testing were missing required federal award information. The eight subawards tested consisted of six subawards from West Virginia University (WVU), one subaward from the Department of Agriculture (Department) and one subaward from the Higher Education Policy Commission (HEPC). The following exceptions were noted: Department of Agriculture: The subaward tested did not contain all required federal award information. The Assistance Listing Number and identification of whether the Federal award was for research and development was omitted from the subaward agreement. Questioned costs: None noted. Cause: The Department does not have sufficient procedures and internal controls to ensure that subawards are issued in compliance with Federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.
Federal Agency: US Department of Agriculture Federal Program Name: Infrastructure Investment and Jobs Act Community Wildfire Defense Grants Cooperative Forestry Assistance Assistance Listing Number: 10.720, 10.664 Federal Award Identification Number, Year and Award Period: ALN 10.720: 23DG11030000019: 7/1/2023 – 12/31/2028 23DG11030000057: 7/1/2023 – 12/31/2026 24DG11030000035: 8/1/2024 – 6/30/2029 ALN 10.664: 20DG11030000007: 7/1/2020 – 12/31/2025 21DG11030000013: 7/1/2021 – 12/31/2025 22DG11030000007: 7/1/2022 – 12/31/2025 23DG11030000008: 7/1/2023 – 12/31/2026 24DG11030000023: 7/1/2024 – 12/31/2027 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Per 2 CFR §200.332 Requirements for pass-through entities, a non-federal entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass_x0002_through entity monitoring of the subrecipient must include reviewing financial and performance reports required by the pass-through entity. Additionally, §200.332 includes required elements that are to be included in the subawards for pass-through entities. Condition: During single audit testwork over subrecipient monitoring, the following issues were noted which are detailed by ALN: ALN 10.720: 5 out of 5 subrecipient samples tested did not have adequate subaward agreements that include the points listed in 2 CFR §200.332 Requirements for pass-through entities. 5 out of 5 subrecipient samples tested listed the incorrect assistance listing number on either the subaward, notice to proceed, or both. ALN 10.664: 9 of 9 subrecipient samples tested did not have adequate subaward agreements that include the points listed in 2 CFR §200.332 Requirements for pass-through entities. 3 of 9 subrecipient samples tested listed the incorrect assistance listing number on either the subaward, notice to proceed, or both. 1 of 9 subrecipient samples were not initially identified as subrecipients for the program due to mapping issues. As result, the Department did not perform any monitoring related to the subrecipient. Questioned costs: None Context: This was identified during Subrecipient Monitoring Testing. The samples described above were statistically valid samples. Cause: The Department has not maintained internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effect: Noncompliance with portions of the applicable regulations. Programmatic monitoring was being performed for the ALNs. Recommendation: We recommend the Department create an agreement template that contains the required elements of a subaward to distribute to its subrecipients. We recommend that the Department conduct training with program staff on required elements of subawards and proper mapping of subrecipients within SHARE.
Finding 2025-046 Compliance with Subrecipient Monitoring for Disaster Grants The Federal Emergency Management Agency (FEMA) Disaster Grants program [ALN 97.036] provides supplemental assistance to recipients to assist communities with responding to and recovering from major disasters or emergencies. The program also provides funding for hazard mitigation measures to help communities implement hazard mitigation projects that can protect them from future disasters. The Disaster Grants program is based on a partnership between FEMA, the recipient (in this case, the Department), and, as applicable, the subrecipient (local governments). FEMA is responsible for managing the Disaster Grants program, approving grants, and providing technical assistance to the state, local, tribal, and territorial governments. The Department, as a recipient of Disaster Grants program funds, is responsible for providing technical advice and assistance to eligible subrecipients, providing support for damage survey activities, ensuring that all potential applicants are aware of funding assistance available, and submitting documents necessary for grant awards. A subrecipient is defined in federal regulations [2 CFR 200.1] as an entity, usually but not limited to non-federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through entity (such as the Department) to an entity (subrecipient) to carry out part of a federal grant award received by the pass-through entity. Specifically for this program, the subrecipient is expected to request assistance, as needed; identify the damaged facilities; provide information to support its funding requests; maintain accurate documentation; and perform other work, as necessary. As part of its subrecipient monitoring process, the Department should complete an annual risk assessment to determine the extent of its subrecipient monitoring activities. The risk assessment should include considerations of financial risk factors, such as financial implications of operational and compliance failures; operational risk factors, such as risks resulting from inadequate internal controls; and compliance risks, such as violations with laws, regulations, and internal policies. In addition, the Department should be using monitoring tools to track the status of whether the subrecipient underwent a Single Audit, if applicable, and whether that audit has been reviewed by Department staff and any resulting management decisions issued by those staff to the subrecipient, if applicable, that address the Department’s assessment and planned actions to address any findings or issues identified in the audit During Fiscal Year 2025, the Department passed approximately $76.0 million to 66 subrecipients for responses to various disasters covered by the Department’s Disaster Grants program. In addition, the Department reported that it approved no new subawards during Fiscal Year 2025. All funds passed through to subrecipients by the Department were related to reimbursements for prior period expenses. In total, the Department reported that it had passed through Disaster Grant funding to another 68 subrecipients in prior years who did not receive funding passed through from the Department during Fiscal Year 2025; many of these subrecipients had multiple open projects that had been completed in prior years but were awaiting final approval and close-out from FEMA. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to determine whether the Department had adequate internal controls in place over, and complied with, subrecipient monitoring requirements over the Disaster Grants program during Fiscal Year 2025. Another purpose of the audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendation to review all subrecipients’ federally-required Single Audit reports, as required. The Department agreed with the recommendation and planned to implement it by June 2025. As part of our audit work, we performed testwork to determine whether the Department obtained its subrecipients’ Single Audit reports and issued a management decision, if applicable. We also determined whether the Department performed risk assessments on the subrecipients as required by federal regulations. Finally, we performed this testing over a random sample of 9 of 68 subrecipients that received pass-through funding in the current year. How were the results of the audit work measured? We measured the results of our audit work against the following requirements: • Federal regulations [2 CFR 200.332] require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate level of subrecipient monitoring based on the Department’s assessment of risk posed by the subrecipients. Additionally, it requires the Department to verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, Audit Requirements, which sets forth the federal regulations around Single Audit threshold requirements for subrecipients. It also covers the federal regulations to consider whether the results of the subrecipient’s audits indicates conditions that necessitate adjustment to the passthrough entity’s—in this case, the Department’s—own records. Further, federal regulations [2 CFR 200.521] require the Department to issue a management decision, which is defined as the Department’s written determination of the adequacy of the subrecipient’s proposed corrective action to address any findings in the subrecipient’s Single Audit reports within 6 months of the federal audit clearinghouse’s acceptance of the audit report. • The Department’s Division of Homeland Security and Emergency Management’s (DHSEM) Subrecipient Monitoring policy states that it “…will perform an annual evaluation of Subrecipient’s risks prior to the start of each State fiscal year, analyzing active awards and assessing Subrecipients for the upcoming year to determine the financial status of each Subrecipient and which subrecipients will receive on-site monitoring which may include desk reviews.” The policy further goes on to indicate that each subrecipient will receive an overall risk score that is used to determine which subrecipients will undergo monitoring review during the fiscal year based on the quantitative and qualitative data used for the assessment inputs. • The DHSEM Subrecipient Monitoring policy also states that “DHSEM will perform reviews of single audit results for Subrecipients who have expended Federal grant funds in excess of $750,000 of which some portion is passed through DHSEM.” • Federal regulations [2 CFR 200.329] stipulate that the non-federal award recipient—in this case the Department—is responsible for oversight of the operations of its federal award-supported activities. The regulations further state that the “non-federal entity” must monitor its activities under federal awards to assure that compliance with applicable federal requirements and performance expectations is being achieved. What problems did the audit work identify? Based on our audit work, we determined that the Department did not fully implement our prior audit recommendation by its planned implementation date of June 30, 2025, and did not complete required subrecipient monitoring activities for its Disaster Grants program. Specifically, we found that the Department did update the risk assessment policies for the 2025 risk assessment and fully assessed risks for subrecipients for Fiscal Year 2025. However, there was one subrecipient that had not yet issued a finalized audit report and, therefore, the Department’s subrecipient monitoring process was pending completion. Why did these problems occur? Although the Department designated staff to obtain and review Single Audit reports for all of its subrecipients, Department staff stated that they were not able to complete their reviews of previously unreviewed Single Audit reports during Fiscal Year 2025, as letters were still being processed for execution and distribution under the updated policies. The Department also subsequently stated that some of these reviews were incomplete due to the subrecipients not yet finalizing their Single Audits with their auditors. Why do these problems matter? By failing to complete all of its reviews of subrecipients’ Single Audit reports, the Department is out of compliance with both federal requirements and with its policy to complete monitoring reviews for each subrecipient. This could result in the Department not timely identifying enforcement actions that may be needed against noncompliant subrecipients and then making revisions, as applicable, to its monitoring risk assessment for the subrecipient. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-046 The Department of Public Safety (Department) should continue to implement its subrecipient monitoring policy and ensure the Department is in compliance with federal regulations to review all subrecipients’ Single Audit reports in a timely manner. This should also include the Department completing its reviews of the subrecipients’ prior year’s Single Audit reports and issuing the management decision letters for those reports. Response Department of Public Safety Agree Implementation Date: June 2026 The Department will continue to follow the current Policy and Procedure related to the Single Audit reviews and has allocated an individual to review the Single Audits. This includes issuing a management decision letter if required, in accordance with the timeline established in federal guidance.
Finding 2025-047 Compliance with Reporting for the Highway Safety Cluster The Department is required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for its Highway Safety Cluster programs, specifically the State and Community Highway Safety [ALN 20.600] and National Priority Safety Programs [ALN 20.616] (Programs). The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public, including information about amounts passed through to subrecipients. The Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations (also referred to as subrecipients). Federal regulation [2 CFR 200.1] defines a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulation [2 CFR 200.1] as an entity, usually but not limited to non-federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. The Department is required to file FFATA reports through the System for Award Management website, SAM.gov. Once the Department submits a report to SAM.gov, the public can view certain information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. In Fiscal Year 2025, the Department reported approximately $12.9 million in total for the Programs’ expenditures. Of this amount, the Department issued about $6.8 million in subawards under the Programs. The Department had 70 subrecipients with subawards it was required to submit FFATA information for through SAM.gov during the fiscal year. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine whether the Department had adequate internal controls over and complied with FFATA reporting requirements for the Highway Safety Cluster Programs during Fiscal Year 2025. Another purpose of our audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendations to strengthen its internal controls over and to ensure it complies with FFATA reporting requirements for the Highway Safety Cluster Programs. The Department agreed with these recommendations and planned to implement them by June 2025. As part of our audit work, we selected 24 Fiscal Year 2025 subrecipient expenditure transactions out of a total of 70 subrecipient transactions for which FFATA reporting was required for these Programs. We obtained copies of the FFATA reports that the Department uploaded to SAM.gov and obtained subaward agreements and purchase orders for each sample. We compared the Department’s subaward information to the information the Department submitted to SAM.gov to determine whether the Department reported accurate information. In addition, we performed testwork to determine whether the Department submitted the FFATA reports within the month following the month it made the subaward, as required by federal regulations. We also tested the Department’s progress in implementing our prior audit recommendations by reviewing their updated policies and procedures. How were the results of the audit work measured? We measured the results of our audit work against the following: • Federal regulations [2 CFR 170] require direct recipients of federal grants to report subawards of $30,000 or more to SAM.gov by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to SAM.gov in May 2025 if an award or supplemental award equal to or greater than $30,000 was made in April 2025. Federal regulations [2 CFR 200.303] require the non-federal entity—in this instance the Department—to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. • Federal regulation [2 CFR 200.332 (a)(1)] states that the Department’s subawards must clearly identify certain information, including but not limited to, the unique entity identifier, the Assistance Listing Number, the federal award date, and the federal award identification number. What problem did the audit work identify? Based on our audit work, we determined that the Department did not fully comply with FFATA reporting requirements for the Programs during Fiscal Year 2025 and did not fully implement our prior audit recommendations. Of the 24 subaward reports selected for testing, we identified issues on 5 subaward reports (21 percent). Specifically, we identified the following issues: • The Department was unable to provide documentation demonstrating that two subaward FFATA reports related to Fiscal Year 2024 awards had been submitted in SAM.gov. These submissions could not be located in SAM.gov. The amount of the subawards not submitted was $375,553. We further noted that these two reports had still not been submitted during Fiscal Year 2025. • For three subawards totaling $771,258, the Department did not maintain adequate documentation to support the amounts reported in SAM.gov. Specifically, the Department reported amounts of $537,573 for the three subawards, which did not agree to the Department’s subaward records, and represented a difference of $233,684. In addition, the Department did not meet the required FFATA reporting timelines for these subawards. Specifically, one subaward was reported 271 days late and two were reported 301 days late. Why did this problem occur? The Department did not have adequate internal controls in place related to FFATA reporting for the Highway Safety Cluster during Fiscal Year 2025 that ensured that reporting occurred as required for subawards of $30,000 or more in SAM.gov by the end of the month following the month the subawards are made. The Department implemented policies and procedures related to FFATA reporting during the fiscal year; however, Department staff indicated that staff were still being trained on these new procedures. In addition, the Department did not have procedures in place to ensure that, when an unsubmitted FFATA report is identified, the report is subsequently filed in SAM.gov, even if the submission is late. Why does this problem matter? By failing to properly report FFATA subawards through SAM.gov, the Department is out of compliance with federal reporting requirements, risks federal sanctions, and does not meet the federal intent of transparency for federal program spending. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-047 The Department of Transportation (Department) should strengthen its internal controls over and ensure it complies with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the Highway Safety Cluster by: A. Ensuring that FFATA reporting occurs as required for subawards of $30,000 or more by the end of the month following the month the subawards are made and, if an unsubmitted FFATA report is identified, subsequently filing the report as soon as possible through SAM.gov, even if the submission is late. B. Providing training to Department staff to follow FFATA reporting policies and procedures. C. Ensuring Department staff follow the Department’s FFATA policies and procedures to ensure that FFATA reports are accurate and complete. Response Department of Transportation A. Agree Implementation Date: June 2026 The Department agrees with the recommendation. The Department will review, assess, and, where necessary, update existing procedures for FFATA reporting relating to the requirement that state subawards for $30,000+ be submitted within 30 days of committed budget. This will include ensuring that the confirmation date is documented. This process will be a coordinated effort between the Office Transportation Safety (OTS) and the Center for Accounting. This will include updating our reconciliation process to include additional data, reviewing and updating reconciliation and review procedures as needed, and reconciling Grants awarded in prior fiscal years that are still active and ensuring they have been appropriately reported. The findings related to this recommendation are in part the result of a federal reporting system limitation, and a federal system conversion. The legacy reporting system, FSRS, had a system limitation, which prevented the full amount of the award being reported in the case of three awards. Additionally, this conversion resulted in some data conversion issues impacting one additional award B. Agree Implementation Date: June 2026 The Department agrees with this finding and will provide any training needed to staff members to ensure that all components of the FFATA are completed accurately, timely and with proper reviews. This training will include leadership reviewing NHTSA/Federal guidelines and SAM.Gov training on FFATA reporting and requirements, documenting controls and ensuring the approvers have access to all supporting schedules, forms and systems and that they understand the subawards, and process for late submissions if needed. C. Agree Implementation Date: June 2026 The Department agrees with the finding and will ensure that staff follow all internal policies and procedures to maintain accurate and complete FFATA reporting. To achieve this, staff will review existing procedures and make any necessary updates regarding report compilation. Additionally, we will review control points to ensure they are consistently followed and approved by the team supervisor or team manager.
The following finding and recommendation relating to an internal control deficiency classified as a Significant Deficiency was communicated to the Department of Transportation (Department) in the previous year and has not been remediated as of June 30, 2025 because the original implementation date provided by the Department was in a subsequent fiscal year. This complete finding and recommendation can be found within the original report and the complete recommendation can be found within Section IV: Disposition of Prior Audit Recommendations of this report. Finding 2024-058 Compliance with Subrecipient Monitoring for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and SLFRF The Department receives federal grant funds directly from the federal government for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program and then subgrants, or passes through, a portion of the funds to cities and counties and other organizations that are considered to be either a subrecipient or a contractor. For Fiscal Year 2024, the Department had the following transactions that were subject to subrecipient monitoring testing: • Formula Grants for Rural Areas and Tribal Transit Program – 783 subrecipient transactions totaling $23,075,270. • Highway Safety Cluster – 829 subrecipient transactions totaling $5,669,865. • SLFRF – 232 subrecipient transactions totaling $38,321,493. For the SLFRF program, Intergovernmental Agreements are executed between the Department and subrecipients to communicate all relevant federal award information. For both the Formula Grants for Rural Areas and Tribal Transit Program and Highway Safety Cluster, Subaward Agreements (subawards) are executed between the Department and subrecipients to communicate all relevant federal award information. Intergovernmental Agreements and subawards are signed by authorized State personnel, generally the State Controller and the Department’s Chief Engineer. The Department includes a “Subrecipient Risk Assessment” tool with its Intergovernmental Agreements or subawards, which must be completed by Department staff prior to making the award. The Department’s subrecipient monitoring procedures are dependent on the assessed risk level noted in the Subrecipient Risk Assessment tool. Federal regulations [2 CFR Part 200 Section F] state that a non-federal entity that expends $1,000,000 or more in federal awards during the non-federal entity’s fiscal year must have a Single Audit conducted in accordance with 2 CFR 200.514. The Department’s Internal Audit Division staff tracks and receives Single Audit reports from its subrecipients. As part of the Department’s monitoring procedures, the Internal Audit Division personnel complete a “Single Audit Report Review Summary” form to show they reviewed the subrecipient’s Single Audit report, summarized any findings, and concluded on any risks presented to the Department and any related future actions to be taken. The form is signed by a Department preparer and a Department reviewer. For those subrecipients not required to file a Single Audit, an “Audit Division Single Audit Certification Form” must still be submitted by the subrecipients to the Department. These forms note that the entity was exempt from a Single Audit. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine if the Department complied with federal requirements for subrecipient monitoring during Fiscal Year 2024 for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and the SLFRF program and to determine whether the Department had adequate internal controls over subrecipient monitoring. As part of our audit work, we reviewed the Department’s internal controls over compliance for subrecipient monitoring and tested the Department’s compliance with federal subrecipient monitoring requirements. Specifically, we performed the following testwork related to each of the following federal programs: • Formula Grants for Rural Areas and Tribal Transit Program—We selected and reviewed a random sample of 40 subrecipient payment transactions. We reviewed subawards, amendments, and other supporting documentation provided by the Department. • Highway Safety Cluster—We selected and reviewed a random sample of 40 subrecipient payment transactions. We reviewed subawards, amendments, and other supporting documentation provided by the Department. • SLFRF—We selected and reviewed a random sample of 29 subrecipient payment transactions. We reviewed Intergovernmental Agreements, amendments, and other supporting documentation provided by the Department. How were the results of the audit work measured? Our audit work was designed to measure the Department’s compliance with the following criteria: • Federal regulation [2 CFR 200.303] states that the Department, as a federal grant recipient, must “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” • Federal regulation [2 CFR 200.332 (a)(1)] states that the Department’s subawards must clearly identify certain information, including but not limited to, the ALN, the Federal Award Date, and the FAIN. • Federal regulation [2 CFR 200.331] states that a pass-through entity, in this case the Department, must make case-by-case determinations as to whether each agreement it makes for the disbursement of federal program funds represents a payment of funds to a subrecipient or a contractor, depending on the role the entity plays. What problems did the audit work identify? We determined that the Department did not fully comply with subrecipient monitoring requirements during Fiscal Year 2024. Specifically, we noted the following: • Formula Grants for Rural Areas and Tribal Transit Program o For 10 of 40 (25 percent) subrecipient payment transactions selected for testing, we determined the subaward documents did not contain the federal award date in the subaward agreement, as required. The 10 transactions totaled $7,432,248 in subrecipient awards. • Highway Safety Cluster o For 1 of 40 (3 percent) subrecipient payment transactions selected for testing, we determined that the subrecipient should have been classified as a contractor, not a subrecipient. The transaction totaled $75,325. The Department had not made an adjusting entry in CORE to reclassify the transaction and correct this error by the end of our audit testwork. o For 5 of 40 (13 percent) subrecipient payment transactions selected for testing, we determined the subaward documents did not contain the federal award date in the subaward agreement. The 5 transactions totaled $25,100 in subrecipient awards. • SLFRF o For 2 of 29 (7 percent) subrecipient payment transactions selected for testing, we determined that the Intergovernmental Agreement did not include the FAIN and Federal Award Dates. The 2 transactions totaled $3,277,779 in subrecipient awards. o For 1 of 29 (3 percent) subrecipient payment transactions selected for testing, we determined the transaction did not include the ALN. This transaction totaled $1,851,279 in subrecipient awards. Why did these problems occur? The Department’s procedures and internal controls were not sufficient to ensure that Intergovernmental Agreements and subawards included all the required information to be included in the subaward, and internal controls did not prevent or detect errors. Department staff were not aware that this information was needed for the subaward to be in compliance with federal regulations. In some situations, the FAIN was only provided to the Department from the U.S. Department of Transportation subsequent to when the subaward was made. In these instances, the Department was not aware that they were required to provide the FAIN to their subrecipients once it was determined by the U.S. Department of Transportation. The Department’s procedures and internal controls were not sufficient to ensure that payments were properly classified as general disbursements or subrecipient payments, and internal controls did not prevent or detect errors. Department staff lacked the appropriate knowledge of the difference in contractors and subrecipients to ensure the proper classification of expenditures. The Department’s reviewers did not complete a sufficient review of the expense classifications to be able to identify the misclassification and propose a subsequent correction. Why do these problems matter? Based on the issues we identified, the Department is out of compliance with federal subrecipient requirements and could face sanctions or other penalties. In addition, by failing to properly report the required federal grant award information at the time of subaward issuance, subrecipients may be uninformed about what funding the subaward related to. This could result in misclassification of subaward information on the subrecipients’ Schedules of Expenditures of Federal Awards (SEFA) and the subrecipient may not know what federal requirements they need to follow as part of receiving the federal award funds. The Department’s improper classification of expenses as general disbursements versus subrecipient payments could lead to misstatements in the amounts reported on the SEFA, both for the State as a whole and at the subrecipient level. See "Schedule of Findings and Questioned Costs" for chart/table. Recommendation 2024-058 The Department of Transportation (Department) should strengthen its internal controls over and ensure that it complies with federal subrecipient monitoring requirements for the Formula Grants for Rural Areas and Tribal Transit Program, the Highway Safety Cluster, and the Coronavirus State and Local Fiscal Recovery Funds. Specifically, the Department should ensure that all required information is included in subawards or intergovernmental agreements or provide amendments to the subawards or intergovernmental once the Department receives the necessary information from the federal government, and that Department staff are sufficiently aware of the difference in subrecipients and contractors and properly classify general disbursements versus subrecipient payments. Response Department of Transportation Agree Implementation Date: June 2026 Department will strengthen controls to ensure that the required award information is provided, once available. Certain information such as Federal Award Identification Number and Federal Transit Administration and National Highway Traffic Safety Administration award date are not available at the time of contracting CDOT is working on a process to provide this information, once it is available in a publicly available format on CDOT’s website or on a subrecipient facing grant management site. We will add a note to the contract explaining where the information will be posted on our site when it becomes available. The Department will also identify staff requiring additional training on classification and coding for contractors vs. subrecipients.
2025-017: Evaluate Subrecipients’ Risk of Noncompliance in Accordance with Federal Regulations Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-085; 2023-100; 2022-016; 2021-071 Finding Type: Internal Control and Compliance Finding Severity: Significant Deficiency Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: Supplemental Nutrition Assistance Program – 10.551; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program – 10.561; Temporary Assistance for Needy Families (TANF) - 93.558; Child Care and Development Block Grant - 93.575; Federal Award ID (Year): 251VA407S2514 (2025); 2501VATANF (2025); 2502VACCDD (2025); 2502VACCDM (2025) Federal Agency: Various Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.332(b) Known Questioned Costs: $0 As in prior years, Benefit Programs is still not confirming that program consultants evaluate each subrecipient’s risk of noncompliance in accordance with its subrecipient monitoring plan. Benefit Programs oversees the Medicaid, SNAP, TANF, and CCDF Cluster federal grant programs. Benefit Programs disbursed over $425 million in grant funding during fiscal year 2025 from these federal grant programs to over 260 subrecipients. In response to prior audit recommendations, Benefit Programs hired a subrecipient monitoring coordinator in fiscal year 2025 and began creating new materials for managing risk assessments and monitoring reviews, including developing a memorandum detailing the schedule and operation for monitoring activities. Additionally, Benefit Programs developed tracking tools to monitor completion of risk assessments and follow-up activities. However, due to the extent of its corrective actions, Benefit Programs did not complete all corrective actions by the end of fiscal year 2025. As a result, we noted the following deviations while auditing Benefit Programs’ fiscal year 2025 subrecipient monitoring activities: Program consultants did not complete programmatic risk assessments for 17 of 42 (40%) non-locality subrecipients with fiscal year payments. Program consultants did not provide an adequate justification for not conducting monitoring reviews for 11 of 76 (14%) locality risk assessments rated high or medium. Program consultants did not complete 15 of 316 (5%) locality programmatic risk assessments. Title 2 CFR § 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Additionally, Benefit Programs’ subrecipient monitoring plan requires that all staff follow its procedures which guides the process and frequency for ongoing subrecipient monitoring of public assistance programs at local departments. Without appropriate oversight of program consultants, Benefit Programs cannot demonstrate proper monitoring of subrecipient activity, including whether the subrecipient used the subawards for authorized purposes and in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Benefit Programs should continue to implement its planned corrective actions to evaluate subrecipient’s risk of noncompliance in accordance with federal regulations. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2025-016: Review Non-Locality Subrecipient Single Audit Reports Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-084; 2023-098; 2022-013; 2021-072; 2020-075; 2019-091; 2018-092 Finding Type: Internal Control and Compliance Finding Severity: Significant Deficiency Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: State Administrative Matching Grants for the Supplemental Nutrition Assistance Program – 10.561; MaryLee Allen Promoting Safe and Stable Families Program - 93.556; Temporary Assistance for Needy Families (TANF) - 93.558; Social Services Block Grant - 93.6 Federal Award ID (Year): 251VA407Q3903 (2025); 2501VATANF (2025); 2502VAFPSS (2025); 2501VASOSR (2025) Federal Agency: Various Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.332(d)(3); 2 CFR § 200.332(f) Known Questioned Costs: $0 Compliance continues to not review non-locality subrecipient Single Audit reports as set forth within Compliance’s Agency Monitoring Plan. Non-locality subrecipients are subrecipients who are not local governments (primarily non-profit organizations). During fiscal year 2025, Social Services disbursed approximately $125 million in federal funds to 252 non-locality subrecipients. Of the 11 non-locality subrecipients that received more than $750,000 in federal funds from Social Services, we identified two (18%) that did not have a Single Audit reporting package available in the Federal Audit Clearinghouse (Clearinghouse) for the most recent audit period; one of which appeared to have never filed a Single Audit reporting package. Since the prior audit, Compliance adopted a policy regarding how to obtain and review information from the Clearinghouse, compiled a list of non-locality subrecipients receiving federal funds, and worked with Social Services’ Contract and Procurement Team to update contract language that requires the non-locality to communicate anticipated federal spending to Social Services so Compliance can monitor adherence with the Single Audit requirements. However, because of the extent of its corrective actions, Compliance was unable to fully implement its corrective action and review all non-locality subrecipient Single Audit reports by fiscal year end. Title 2 CFR § 200.332(f) requires pass-through entities to verify that subrecipients expending $750,000 or more in federal awards during the fiscal year obtain a Single Audit. Additionally, Compliance’s Agency Monitoring Plan requires the subrecipient monitoring coordinator to reference a comprehensive list of non-locality subrecipients and corresponding federal expenditures, identify subrecipients required to obtain a Single Audit, verify submission of those audits to the Clearinghouse, and follow up with subrecipients that have not complied. Without verifying whether non-locality subrecipients receive a Single Audit, Compliance is unable to provide assurance that Social Services is fulfilling its responsibilities as a pass-through entity. By not reviewing non-locality subrecipient Single Audit reports, Social Services may be unaware of a potential liability to the Commonwealth. Not complying with federal regulations could result in federal awarding agencies temporarily withholding payments until Social Services takes corrective action; disallowing costs for all or part of the activity associated with the noncompliance; suspending or terminating the federal award in part or in its entirety; initiating initial suspension or debarment proceedings; and/or withholding further federal funds for the project or program. Compliance should continue its corrective action efforts and begin reviewing non-locality subrecipient Single Audit reports. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2025-014: Perform Responsibilities Outlined in the Agency Monitoring Plan Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-082; 2023-097; 2022-011; 2021-070; 2020-074; 2019-090; 2018-093 Finding Type: Internal Control and Compliance Finding Severity: Material Weakness Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: Grants to States for Medicaid – 93.778 Federal Award ID (Year): 2505VA5MAP (2025) Federal Agency: U.S. Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.303(a); 2 CFR § 200.332 Known Questioned Costs: $0 The Department of Social Services (Social Services) Compliance Division (Compliance) continues not to adhere to its established approach for overseeing agency-wide subrecipient monitoring, as outlined in its Agency Monitoring Plan. In response to the prior audit recommendations, Compliance made significant revisions to its Agency Monitoring Plan to include tools for tracking and monitoring division-level subrecipient monitoring reviews, began meeting monthly with division-level subrecipient monitoring coordinators, and developed a quarterly variance report that it will use to report the status of the agency’s subrecipient monitoring activities to Social Services’ Executive Team. Compliance adopted its revised Agency Monitoring Plan in July 2025 and anticipates completing the remainder of its corrective actions by the end of fiscal year 2026. Additionally, Social Services hired a director to lead Compliance in fiscal year 2025. Social Services engaged a consultant in April 2025 to help develop remediation plans for its previous audit findings. However, because of the extent of its corrective actions, Compliance could not design and implement its corrective actions by the end of fiscal year 2025. As a result, we identified the following deviations from the Agency Monitoring Plan: Compliance did not review programmatic division annual subrecipient monitoring plans to ensure they implement a risk-based approach. The Agency Monitoring Plan states that Compliance will use a monitoring plan checklist to evaluate and determine if all the required elements for subrecipient monitoring are present in each division’s plan. As a result, Compliance was not aware that the Division of Benefit Programs' (Benefit Programs) non-locality risk assessment template did not include all required risk factors outlined in the Agency Monitoring Plan. Compliance did not confirm that division-level subrecipient monitoring coordinators are maintaining monitoring documentation in Compliance’s centralized repository. As a result, Compliance could not confirm the completeness of the centralized repository. The Agency Monitoring Plan requires that Compliance monitor whether divisions post monitoring review reports to the centralized repository. Compliance did not review each division’s monitoring activities nor provide the required quarterly reports of variances and noncompliance from the Agency Monitoring Plan to Social Services’ Executive Team. As a result, Compliance and the Executive Team were not aware that Benefit Programs did not comply with certain aspects of its subrecipient monitoring plan, such as maintaining complete sampling documentation, monitoring records and reports, and documenting subsequent corrective action. Title 2 U.S. Code of Federal Regulations (CFR) § 200.303(a) requires pass-through entities to establish, document, and maintain effective internal control over federal awards to ensure compliance with applicable laws, regulations, and award terms. Further, 2 CFR § 200.332 requires pass-through entities to monitor subrecipients to ensure they meet federal requirements. Finally, the Agency Monitoring Plan establishes Compliance’s responsibility to centrally coordinate, review, and report on subrecipient monitoring activities across all divisions. Compliance is responsible for agency-wide compliance and risk mitigation that helps ensure adherence to state and federal legal and regulatory standards. During fiscal year 2025, Social Services disbursed approximately $700 million in federal funds to roughly 350 subrecipients from 37 federal grant programs. Without performing the responsibilities in the Agency Monitoring Plan, Compliance cannot provide the Executive Team with assurance that Social Services’ subrecipient monitoring efforts are adequate to comply with the regulations at 2 CFR § 200.332. Additionally, Compliance places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards by not monitoring the agency’s subrecipient monitoring activities. Because of the scope of this matter and the magnitude of Social Services’ subrecipient monitoring responsibilities, we consider these weaknesses collectively to create a material weakness in internal controls since Compliance did not implement its corrective actions by the end of fiscal year 2025. Compliance should continue to implement its planned corrective actions to perform the responsibilities outlined in its Agency Monitoring Plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2025-018: Confirm Monitoring Activities are Conducted in Accordance with the Monitoring Plan Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-086; 2023-102; 2022-014 Finding Type: Internal Control and Compliance Finding Severity: Significant Deficiency Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: Supplemental Nutrition Assistance Program – 10.551; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program – 10.561; Temporary Assistance for Needy Families (TANF) - 93.558; Child Care and Development Block Grant - 93.575; Federal Award ID (Year): 2501VATANF (2025); 2505VA5MAP (2025); 251VA407Q3903 (2025); 2502VACCDD (2025); 2502VACCDM (2025) Federal Agency: Various Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.332(e) Known Questioned Costs: $0 Benefit Programs continues to not confirm that program consultants complete required subrecipient monitoring procedures and/or document their work in accordance with its subrecipient monitoring plan. Benefit Programs oversees the Medicaid, SNAP, TANF, and CCDF Cluster federal grant programs. Benefit Programs disbursed over $425 million in grant funding during fiscal year 2025 from these federal grant programs to over 260 subrecipients. In response to prior audit recommendations, Benefit Programs hired a subrecipient monitoring coordinator in fiscal year 2025 and began creating new materials for managing risk assessments and monitoring reviews, including developing a memorandum detailing the schedule and operations for monitoring activities. However, due to the extent of its corrective actions, Benefit Programs did not complete its corrective actions by the end of fiscal year 2025. As a result, Benefit Programs did not identify incomplete sampling documentation, missing monitoring records, untimely locality notifications, incomplete monitoring reports, or insufficient documentation of corrective actions across multiple locality reviews. While reviewing fiscal year 2025 monitoring activities, we noted the following deviations from Benefit Programs’ subrecipient monitoring plan: Benefit Programs did not confirm that program consultants uploaded all required monitoring records to the data repository. As a result, Benefit Programs could not provide complete documentation for six out of 20 locality reviews (30%). Benefit Programs did not confirm that program consultants maintained complete sampling documents and final locality review reports for five out of 20 locality reviews (25%). Benefit Programs did not confirm that program consultants fully documented corrective actions for five out of 20 locality reviews (25%). Benefit Programs did not confirm that program consultants selected and documented sampling units appropriately. As a result, three out of 20 locality reviews (15%) lacked sufficient documentation of sampling units, and one out of 20 reviews (5%) did not include the required number of sampled cases. Benefit Programs did not confirm that program consultants included all required elements in their final monitoring review reports in two out of the 20 locality reviews (10%). Benefit Programs did not confirm that program consultants provided timely notification to localities for the monitoring review for one out of 20 locality reviews (5%). Title 2 CFR § 200.332(e) requires pass-through entities to monitor subrecipients use of subawards for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the award. Benefit Programs’ subrecipient monitoring plan outlines the required monitoring steps, documentation standards, and timelines necessary to comply with this regulation. Without confirming that program consultants complete monitoring activities in accordance with its monitoring plan, Benefit Programs cannot provide reasonable assurance that it complied with federal monitoring requirements. These deficiencies can increase the risk of undetected noncompliance, disallowed expenditures, and potential suspension or termination of federal awards. Benefit Programs should continue to implement its planned corrective actions to confirm that program consultants conduct subrecipient monitoring activities in accordance with its monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2025-001 - Material Weakness in Internal Control and Material Compliance over Subrecipient Monitoring: Incomplete Subaward Agreements Identification of federal programs: Federal Agency: Department of Commerce (DOI) ALN: 11.438 – Pacific Coast Salmon Recovery Pacific Salmon Treaty Program Award Numbers: NA22NMF4380226, NA20NMF4380258, and NA21NMF4380467 Criteria: Per 2 CFR 200.332(a), pass-through entities must provide specific information to subrecipients at the time of the subaward, including but not limited to: Subrecipient name, UEI, and contact information Federal Award Identification Number (FAIN) Federal award date Period of performance CFDA/ALN number and program name Total amount of federal funds obligated All requirements imposed by the pass-through entity Indirect cost rate information Provisions for closeout Failure to include the required information limits the subrecipient’s ability to comply with federal requirements. Condition: During our testing of subrecipient monitoring, we noted that the subawards were missing elements under 2 CFR 200.332(a), including the assistance listing number and amount of federal funds obligated. Further, these relevant compliance requirements were not communicated to the subrecipients at any other time in writing. The entity made subaward payments totaling $784,907 during the audit period without maintaining complete documentation demonstrating compliance with federal subaward requirements. Cause: Pass through funding through subawards was new for the Organization and they were not familiar with subrecipient disclosure requirements. Effect or potential effect: Failure to issue complete subaward agreements increases the likelihood that subrecipients may not comply with federal requirements. These deficiencies represent a material weakness because they indicate a reasonable possibility that material noncompliance with federal requirements could occur and not be prevented or detected. Questioned Costs: None. Context: There were seven subrecipients under the program. In 2025, subrecipient expenditures totaled $784,907. Identification of Repeat Finding: Not applicable. Recommendations: Management should implement a standardized subaward agreement template that incorporates all elements required by 2 CFR 200.332(a). Views of Responsible Officials: See Corrective Action Plan.
2025-002 Material Weakness in Internal Control and Material Compliance over Subrecipient Monitoring: Failure to Verify Single Audit Requirement and Follow Up on Findings Identification of federal programs: Federal Agency: Department of Commerce (DOI) ALN: 11.438 Pacific Coast Salmon Recovery Pacific Salmon Treaty Program Awards: NA22NMF4380226, NA20NMF4380258, and NA21NMF4380467 Criteria: The entity did not verify whether subrecipients who expended $750,000 or more in federal funds obtained the required single audit. Additionally, the entity did not document any follow-up or management decisions on potential subrecipient audit findings. Under 2 CFR 200.332(f)–(g), pass-through entities must: Verify that subrecipients expending $750,000 or more in federal awards during the fiscal year have obtained a single audit in accordance with Subpart F. Review subrecipient audits to determine whether findings related to the program exist. Issue management decisions on audit findings, when applicable, and ensure timely corrective action. Condition: During our testing of subrecipient monitoring, we identified significant deficiencies in the entity’s processes for determining whether subrecipients were required to obtain a Single Audit and for following up on known audit findings: The entity did not document whether the subrecipient spent $750,000 or more in federal awards and therefore did not determine whether a Single Audit was required under 2 CFR 200.501(a). One subrecipients had publicly available Single Audit reports that included material weaknesses, yet the entity did not obtain the audit reports, review them, or follow up on corrective action plans. No documentation was maintained to demonstrate that the entity performed annual verification of audit status, reviewed the Federal Audit Clearinghouse, or communicated with subrecipients regarding audit results. Recommendations: We recommend the entity develop and implement written procedures to: Annually assess subrecipient federal expenditures to determine single audit requirements, obtain and review subrecipient audit reports, including follow-up on any findings, document management decisions and track corrective action until resolution. Views of Responsible Officials: See Corrective Action Plan. Cause: The entity lacks formal policies and procedures for monitoring subrecipients in conformance with Uniform Guidance, including annual confirmation of federal expenditures and review of audit reports. Effect or potential effect: Failure to verify audit requirements and follow up on findings limits the entity’s ability to ensure subrecipients comply with federal regulations. This increases the risk of unaddressed noncompliance, misuse of federal funds, and potential liability for the pass-through entity. Questioned Costs: None. Context: There were seven subrecipients under the program of which 4 subrecipients were reviewed related to the monitoring of audit requirements. In 2025, subrecipient expenditures totaled $784,907. Identification of Repeat Finding: Not applicable.
Finding Reference 2025-004 Federal Agency: U.S. Department of Housing and Urban Development Pass-Through Agency: P.R. Department of Housing Program: Community Development Block Grant/State’s Program and Non-Entitlement Grants in Hawaii (Assistance Listing No. 14.228) Compliance Requirement: Reporting (L) Type of Finding: Significant Deficiency (SD), Instance of Noncompliance (NC) This finding is similar to prior-year finding 2023-004 and 2024-004. Statement of Condition In our reporting test, we evaluate four (4) quarterly reports and two (2) of them were not submitted and one (1) was submitted late. Additionally, two (2) quarterly reports that were submitted do not agree with the accounting records. Criteria Based on the CDBG agreements, the Municipality must submit to the Department of Housing reports on records, collections, and disbursements of Program Income on an annual and quarterly basis. Including the progress of the projects developed with the CDBG program. In addition, the Municipality will submit all the reports required by the Agency. Failure to comply with this provision will be just cause for the Department to stop the fund requisition process. § 200.332 Requirements for pass-through entities. (1) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award. (2) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports. Cause of Condition The Municipality does not have the necessary personnel assigned to prepare and present reports in a timely manner. Effect of Condition The program is not in compliance with the reporting requirements as established in the contract agreement. Recommendation We recommend that the Municipality maintain constant monitoring to improve program controls. The reports must be presented as established in the agreement and guidelines of the Department of Housing. This will ensure compliance with the reporting requirements under the Community Development Block Grants/State’s Program and Non-entitlement Grant in Hawaii agreement. Questioned Cost None Prior Year Finding Yes. This finding is similar to prior-year finding 2023-004 and 2024-004. Views of Responsible Officials and Planned Corrective Action We concur with the findings. The Municipality will be implementing the following measures to address the finding related to the late filing of the quarterly reports of the CDBG Program: 1. An accountant was hired to assume direct responsibility for the preparation, review, and filing of the CDBG Program's financial and programmatic reports. 2. Technical guidance was requested and received from the Department of Housing to ensure proper preparation and compliance with applicable reporting requirements. 3. All overdue quarterly reports and corresponding reports were filed until December 2025, including the reconciliation of the requisitioned balances versus the paid balances. 4. An internal compliance calendar was established, with deadlines and administrative supervision, to ensure timely filing in future periods. Implementation Date: December 31, 2025 Responsible Person: Pedro Santiago Federal Programs Director
Federal Agency: U.S. Department of Health and Human Services Federal Program Title: • Emerging Infections Programs • Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Numbers: • 93.317 • 93.323 Award Periods: • NU50CK000649 (1/1/2024 – 12/31/2028) (93.317) • NU50CK000548 (8/1/2019 – 7/31/2024) (93.323) • NU50CK000346 (8/1/2024 – 7/31/2029) (93.323) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement: Per §200.332, Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: We noted during our testing the programs did not evaluate the subrecipient’s risk of noncompliance with a subaward to determine appropriate subrecipient monitoring. While the Department has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with federal laws, regulations, and program compliance requirements as well as Department policy. Questioned Costs: None Cause: The Department continues to lack established subrecipient monitoring internal controls and procedures that comply with the uniform administrative requirements. Effect: The Department was not in compliance with federal award subrecipient monitoring requirements. Continued noncompliance could result in sanctions by the federal awarding agency, including withholding future funding. Repeat Finding: Yes 2025-008 (2024-005) Subrecipient Monitoring (Significant Deficiency, Other Noncompliance) (Continued) Recommendation: The Department should establish policies and procedures to ensure monitoring activities are performed for all subawards. Agency Response: The Department acknowledges this finding and provides a corrective action plan to prevent future similar findings. The Department does not have written procedures in place to ensure subrecipient expenditures are incurred for authorized purposes in accordance with the terms and conditions of the subaward. The Department has implemented new policies and procedures to ensure subrecipient activity controls and processes are performed for all subawards. The Division Heads will monitor their program staff and grant administrators to ensure that they are monitoring grantee activities of subrecipients to ensure that subaward is used for authorized purposes, in compliance with Federal statues, regulations and terms and conditions of the subaward. The Department is working on remediation of this finding and anticipates completion before June 30, 2026. This action plan will comply with 2 CFR Part 200 Uniform Administrative Requirements, Post Federal Award Requirements and Cost Principles for Federal Award. Responsible Persons: Federal Grants Director, Chief Procurement Officer, Contract Managers, Division Finance Directors, and Grant Administrators.
Condition: During our audit we reviewed the partnership agreement with the subrecipient. We noted the Organization did not include all required information in the partnership agreement. Criteria: As described in 2 CFR § 200.332, the Organization is required to have specific information described in the agreements with subrecipients. Cause: During the year, the Organization received a grant that specifically named the subrecipient. Due to this situation, the agreement between the Organization and the subrecipient was missing required information. Effect: Due to not including all required information in the partnership agreement with the subrecipient, this caused unclear or unknown requirements in the partnership agreement. Recommendation: After thoroughly reviewing the unique circumstance that led to this audit finding, we have determined that it is highly unlikely to recur. Given the Organization's strong compliance history and familiarity with subrecipient requirements under Uniform Guidance, we do not see a cost-effective benefit to revamping internal controls specifically for this issue. Instead, we recommend continuing to; review government awards, provide refresher trainings to staff, and conduct periodic reviews of internal controls to ensure ongoing compliance. These measures will effectively address the finding without incurring unnecessary costs. Views of Responsible Officials: Management agrees with the finding.
Program: AL 84.010 – Title I Grants to Local Educational Agencies – Subrecipient Monitoring Grant Number & Year: All open, including S010A230027, FFY 2024; S010A240027, FFY 2025 Federal Grantor Agency: U.S. Department of Education Criteria: 2 CFR § 200.332 (January 1, 2024, and January 1, 2025) requires a pass-through entity to monitor the activities of subrecipients as necessary to ensure that subaward funds are used for authorized purposes in compliance with Federal regulations, track Single audit requirements and verify that a Single audit was obtained if required, review financial and performance reports of the subrecipient, and follow-up and resolve all audit finding pertaining to the Federal award. 2 CFR § 200.501 (January 1, 2024), as it applies to audit requirements of entities for fiscal years ended prior to October 1, 2025, states the following: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single audit conducted in accordance with § 200.514[.] Good internal control requires policies and procedures to ensure that subrecipient monitoring is sufficiently designed and performed regularly to provide assurance that grant funds are used in accordance with Federal requirements. This includes maintaining adequate documentation to support fiscal monitoring performed for Federal programs and documentation of follow-up procedures performed when subrecipients are expected to have Federal expenditures exceeding Federal audit requirement thresholds but do not receive a Federal Single audit. Condition: The Agency’s procedures can be improved to ensure that: • Subrecipients’ uses of funds were monitored to ensure compliance with all Federal and grant requirements. • Subrecipients obtain Single audits mandated by Federal requirements. Repeat Finding: No Questioned Costs: None Statistical Sample: No Context: The Agency disbursed $106,911,261 of Title I Federal funds to 242 different subrecipients during the fiscal year ended June 30, 2025. We noted the following during our subrecipient monitoring testing. Insufficient Subrecipient Fiscal Monitoring Procedures Per its fiscal monitoring procedures and schedule, the Agency is to perform fiscal monitoring of the various subrecipients on a three-year rotational cycle. These procedures include reviewing subrecipient expenditures claimed for subgrant awards applicable for the period the Agency is monitoring. We randomly selected 25 subrecipients to review the fiscal monitoring documentation provided by the Agency. We noted the following for two subrecipients: • For one subrecipient tested, the fiscal monitoring was last completed in August 2021 for the 2019–2020 program year, during which no compliance errors were noted. Per the Agency, fiscal monitoring was scheduled to be performed again in calendar year 2023 for the 2022–2023 program year; however, this monitoring was never performed. As of June 30, 2025, no fiscal monitoring review had been initiated. Additionally, during a review of reimbursement requests submitted during the fiscal year, we noted some questionable expenditures, including $3,027 spent on hotels at Disney’s Animal Kingdom in Florida, which were reportedly in association with a teaching conference held eight miles away at the Orlando World Center Marriott. The daily rate charged by the hotel was $299 per night; the Government Services Administration’s rate for lodging in Orlando for June 2024 was $140 per night. We also noted that a possible travel expenditure of $955 was paid to Holiday Express for which no support was obtained. These types of higher-risk expenditures further highlight the need for subrecipient monitoring to be performed regularly. • For another subrecipient, the Agency last completed its fiscal monitoring in August 2025 for the 2023–2024 program year. However, monitoring documentation was not sufficient to determine what monitoring procedures were completed or whether that monitoring was adequate. While we did observe various records on file, including employee time and effort logs and invoices supporting supplies and service costs, the audit worksheet that the Agency is supposed to complete for all fiscal monitoring performed did not indicate what items were reviewed or the conclusion regarding those items. We did observe an exit letter issued by the Agency in August 2025, which indicated that no issues were found. Single Audit Tracking Procedures During our review of subrecipient audits and Single audit tracking procedures implemented by the Agency, we noted that, for one subrecipient tested, the Agency had identified the subrecipient as having more than $750,000 in Federal expenditures for the subrecipient’s fiscal year ended August 31, 2024, but noted that no Single audit was required. After we inquired with the Agency, no documentation could be provided to support that the Agency performed any follow-up procedures to verify that a Single audit was not required. Cause: Inadequate procedures to ensure that subrecipients complied with all Federal and grant requirements or to ensure that subrecipients obtained Single audits when required. Effect: Without adequate monitoring and review procedures, there is an increased risk that Federal awards could be used for unallowable costs. Recommendation: We recommend the Agency strengthen procedures to ensure that subrecipient monitoring is properly designed to ensure compliance with all Federal and grant requirements and that documentation is maintained to support procedures performed. We also recommend the Agency strengthen procedures to ensure that subrecipient Single audit requirements are properly tracked, and all Single audits are reviewed in a timely manner. Management Response: NDE agrees with this finding.