2024-001 – Subrecipient Monitoring Federal Program: Refugee and Entrant Assistance Program Federal Agency: U.S. Department of Health and Human Services Assistance Listing Number: 93.566 Repeat of Prior Finding: Yes, initial finding during fiscal year 2023. Finding 2023-006. Type of Finding: Noncompliance and Material Weakness in Internal Controls Over Compliance Criteria According to 2 CFR §200.331, a pass-through entity must adhere to the provisions in 2 CFR §200.332 which require passthrough entities to perform certain subrecipient monitoring procedures. These procedures include providing the subrecipient necessary award information so that the federal award is used in accordance with federal regulations, evaluating risks of noncompliance of subrecipients, implementing monitoring procedures based upon identified risks, and, if applicable, obtaining a copy of the subrecipients’ annual audit, and taking appropriate action on deficiencies detected through the audits, as well as other requirements. Additionally, the nonfederal entity must establish and maintain effective internal controls over the federal award to provide reasonable assurance that the non-federal entity is managing the award in compliance with federal regulations. Further, according to 2 CFR §200.331(a), specific information must be explicitly included in agreements with subrecipients that includes but is not limited to providing the Assistance Listing number, whether funding is COVID related, and that the subrecipient is responsible for compliance with 2 CFR §200 including Subpart F, if applicable. Condition and Context The Organization did not have procedures and adequate internal controls in place during the fiscal year to ensure the terms and conditions of the subaward required by 2 CFR §200.332 were provided to the subrecipient in a timely manner prior to disbursing the federal funds. Cause The Organization lacked a formal process during the fiscal year for providing subaward agreements or written notifications to subrecipients regarding federal award terms and conditions in accordance with applicable regulations prior to awarding the subaward. Effect or Potential Effect Without providing the subrecipient with details on the subaward as required at the time the subaward is made, subrecipients may be unaware that their award is subject to federal compliance requirements. Questioned Costs None noted. Recommendations We recommend developing and implementing formal procedures to ensure all subrecipients are provided with a written subaward agreement or equivalent documentation stating the required award details at the time of the subaward. Views of Responsible Officials and Planned Corrective Actions Management agrees with the finding and recommendations. See the attached corrective action plan.
Criteria: According to grant terms & conditions and 2 CFR Section 200.332, all awardees of applicable grants and cooperative agreements are required to report to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) on all subawards over $30,000. Condition: The Commission did not provide timely FFATA reporting for ALN #11.469 and #11.472 subawards subject to the FFATA reporting requirements. Context: This is a condition identified based on review of grant terms and conditions and 2 CFR Section 200.332. Cause: The Commission was not aware of this reporting requirement. Effect: The Commission is not in compliance with FFATA reporting requirements for fiscal year 2024. Identification of a Repeat Finding: This is not a repeat finding. Recommendation: We suggest that management review all awards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. Views of Responsible Officials: The Commission agrees with the finding. Planned Corrective Action: The Commission will review all subawards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. The Commission will add a clause in our Sub-awards stating this requirement. Responsible Official: Laura Leach, Director of Finance and Administration Anticipated Completion Date: December 31, 2024
Criteria: According to grant terms & conditions and 2 CFR Section 200.332, all awardees of applicable grants and cooperative agreements are required to report to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) on all subawards over $30,000. Condition: The Commission did not provide timely FFATA reporting for ALN #11.469 and #11.472 subawards subject to the FFATA reporting requirements. Context: This is a condition identified based on review of grant terms and conditions and 2 CFR Section 200.332. Cause: The Commission was not aware of this reporting requirement. Effect: The Commission is not in compliance with FFATA reporting requirements for fiscal year 2024. Identification of a Repeat Finding: This is not a repeat finding. Recommendation: We suggest that management review all awards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. Views of Responsible Officials: The Commission agrees with the finding. Planned Corrective Action: The Commission will review all subawards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. The Commission will add a clause in our Sub-awards stating this requirement. Responsible Official: Laura Leach, Director of Finance and Administration Anticipated Completion Date: December 31, 2024
U.S. Department of the Interior National Park ServiceFinding Number 2024-001, Instance of Non-Compliance Reporting, Assistance Listing # 15.954, Questioned Cost $0Criteria: According to 2 CFR Section 200.332, all awardees of applicable grants and cooperative agreements are required to report to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) on all subawards over $30,000.Condition: The Trust did not provide timely FFATA reporting for ALN #15.954 subawards subject to the FFATA reporting requirements. Context: This is a condition identified based on review of 2 CFR Section 200.332. Cause: The Trust was not aware of this reporting requirement. Effect: The Trust is not in compliance with FFATA reporting requirements for the fiscal year 2024. Identification of a Repeat Finding: This is not a repeat finding. Recommendation: We suggest that management review all awards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. Views of Responsible Officials: The Trust agrees with the finding. Planned Corrective Action: The Trust will review all subawards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. The Trust will add a clause in the Sub-awards stating this requirement and will submit FFATA reports immediately upon subaward disbursement. Responsible Official: Mike Hoehn, Senior Director of Finance and Administration. Anticipated Completion Date: This was completed on November 22, 2024.
U.S. Department of the Interior National Park ServiceFinding Number 2024-001, Instance of Non-Compliance Reporting, Assistance Listing # 15.954, Questioned Cost $0Criteria: According to 2 CFR Section 200.332, all awardees of applicable grants and cooperative agreements are required to report to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) on all subawards over $30,000.Condition: The Trust did not provide timely FFATA reporting for ALN #15.954 subawards subject to the FFATA reporting requirements. Context: This is a condition identified based on review of 2 CFR Section 200.332. Cause: The Trust was not aware of this reporting requirement. Effect: The Trust is not in compliance with FFATA reporting requirements for the fiscal year 2024. Identification of a Repeat Finding: This is not a repeat finding. Recommendation: We suggest that management review all awards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. Views of Responsible Officials: The Trust agrees with the finding. Planned Corrective Action: The Trust will review all subawards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. The Trust will add a clause in the Sub-awards stating this requirement and will submit FFATA reports immediately upon subaward disbursement. Responsible Official: Mike Hoehn, Senior Director of Finance and Administration. Anticipated Completion Date: This was completed on November 22, 2024.
U.S. Department of the Interior National Park ServiceFinding Number 2024-001, Instance of Non-Compliance Reporting, Assistance Listing # 15.954, Questioned Cost $0Criteria: According to 2 CFR Section 200.332, all awardees of applicable grants and cooperative agreements are required to report to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) on all subawards over $30,000.Condition: The Trust did not provide timely FFATA reporting for ALN #15.954 subawards subject to the FFATA reporting requirements. Context: This is a condition identified based on review of 2 CFR Section 200.332. Cause: The Trust was not aware of this reporting requirement. Effect: The Trust is not in compliance with FFATA reporting requirements for the fiscal year 2024. Identification of a Repeat Finding: This is not a repeat finding. Recommendation: We suggest that management review all awards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. Views of Responsible Officials: The Trust agrees with the finding. Planned Corrective Action: The Trust will review all subawards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. The Trust will add a clause in the Sub-awards stating this requirement and will submit FFATA reports immediately upon subaward disbursement. Responsible Official: Mike Hoehn, Senior Director of Finance and Administration. Anticipated Completion Date: This was completed on November 22, 2024.
U.S. Department of the Interior National Park ServiceFinding Number 2024-001, Instance of Non-Compliance Reporting, Assistance Listing # 15.954, Questioned Cost $0Criteria: According to 2 CFR Section 200.332, all awardees of applicable grants and cooperative agreements are required to report to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS) on all subawards over $30,000.Condition: The Trust did not provide timely FFATA reporting for ALN #15.954 subawards subject to the FFATA reporting requirements. Context: This is a condition identified based on review of 2 CFR Section 200.332. Cause: The Trust was not aware of this reporting requirement. Effect: The Trust is not in compliance with FFATA reporting requirements for the fiscal year 2024. Identification of a Repeat Finding: This is not a repeat finding. Recommendation: We suggest that management review all awards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. Views of Responsible Officials: The Trust agrees with the finding. Planned Corrective Action: The Trust will review all subawards for subrecipients and ensure that FFATA reporting is completed in a timely manner for subawards subject to the requirements. The Trust will add a clause in the Sub-awards stating this requirement and will submit FFATA reports immediately upon subaward disbursement. Responsible Official: Mike Hoehn, Senior Director of Finance and Administration. Anticipated Completion Date: This was completed on November 22, 2024.
2024-003 Finding Federal Program Information Funding Agency: U.S. Department of Education Title: 21ST Century Community Learning Centers AL Number: 84.287 Criteria The Cooperative is responsible for overseeing and monitoring subrecipients and must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining appropriate subrecipient monitoring. (2 CFR section 200.332(b)) Condition The Cooperative does not review subrecipient audit reports. Questioned Costs None. Context We reviewed 12 of the 12 subrecipient monitoring reports. The Cooperative does not review the subrecipient audit reports. Effect The Cooperative did not properly monitor the subrecipients, which could lead to noncompliance. Cause During our testing of the Cooperative’s internal controls, it was noted that there was not proper controls in place for subrecipient monitoring. Repeat Finding This is a repeat finding of 2023-003. Recommendation The Cooperative should ensure controls are in place to properly review and monitor subrecipients. Management’s Response The Cooperative agrees with the recommendation and will ensure controls are in place to properly review and monitor subrecipients.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
Federal program: All federal awards provided to subrecipients. FY/Federal Award ID#: FY2024/All federal awards provided to subrecipients. Federal agency: All federal awards provided to subrecipients. Pass thru entity: All federal awards provided to subrecipients. Criteria: per 24 CFR 574.500 -- Responsibility for grant administration: (a) General. Grantees are responsible for ensuring that grants are administered in accordance with the requirements of this part and other applicable laws. Grantees are responsible for ensuring that their respective subrecipients carry out activities in compliance with all applicable requirements. (b) Grant agreement. The grant agreement will provide that the grantee agrees, and will ensure that each subrecipient agrees, to: (1) Operate the program in accordance with the provisions of these regulations and other applicable HUD regulations; (2) Conduct an ongoing assessment of the housing assistance and supportive services required by the participants in the program; (3) Assure the adequate provision of supportive services to the participants in the program; and (4) Comply with such other terms and conditions, including recordkeeping and reports (which must include racial and ethnic data on participants) for program monitoring and evaluation purposes, as HUD may establish for purposes of carrying out the program in an effective and efficient manner. And 24 CFR 574.500 Applicability of Uniform Administrative Requirements as per 2 CFR 200.332(f) Requirements for pass-through entities. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. Condition: The Foundation is not in compliance with recordkeeping for program monitoring and evaluation, as the Foundation did not comprehensively asses all subrecipients using riskbased/ subrecipient monitoring policies and procedures. Questioned Costs: None noted. Cause: Staff were not aware of the extent of the requirements to monitor program and fiscal compliance of project sponsors and document results and evidence of compliance or non-compliance. Therefore, a number of project sponsors/subrecipients were not monitored. Effect: Granting agencies cannot determine whether the Foundation is ensuring that the project sponsor is carrying out activities in compliance with all applicable requirements. Recommendation: The Foundation provide written policies and procedures for project sponsor monitoring and oversight, create a risk analysis form/process for all funded project sponsors and create a timeline to monitor project sponsors based on the risk analysis completed. Views of Responsible Officials: The Foundation has updated its Quality Management Plan to include comprehensive subrecipient monitoring policies. The Quality Management team is working with all programming to implement a robust monitoring process, including risk assessments, adherence to grantor regulations, service delivery, and program outcomes.
FINDING 2024-001 – LACK OF DOCUMENTATION FOR VERIFICATION OF SUBRECIPIENT MONITORING ACTIVITIES Condition: Limited documentation to evidence compliance with federal regulations related to certain subrecipient monitoring activities. Criteria: As defined in 2 CFR section 200.332 a pass-through entity must document the risk assessment of each subrecipient and document monitoring activities performed. Cause: Limited documentation to evidence subrecipient risk assessment and monitoring activities. Effect: Subrecipient may not be in compliance with federal or grant award provisions. Questioned Costs: None Recommendation: We recommend the Organization maintain documentation that evidences its compliance with required subrecipient monitoring activities in accordance with 2 CFR 200. Management’s Response: The Organization has maintained the same process for the last several years, including up front determination of subrecipient risk, use of funds solely with low-risk subrecipients, and detailed annual review of expenditures. Accordingly, no costs have been questioned. Management will ensure written documentation is maintained as evidence of this process.
2024-001 Internal Controls Systems and Compliance Over Subrecipient Monitoring – U.S. Department of Treasury, COVID-19 Coronavirus State and Local Fiscal Recovery Funds, Passed Through the State of Nevada Department of Education Criteria: In accordance with 2 CFR 200.332(a)(1), the auditee must maintain a system of internal control to ensure information related to federal awards is clearly identified to the subrecipient at the time of the subaward and if any data elements change, include the changes in a subsequent subaward modification. Internal Controls Systems and Compliance Over Subrecipient Monitoring – U.S. Department of Treasury, COVID-19 Coronavirus State and Local Fiscal Recovery Funds, Passed Through the State of Nevada Department of Education (Continued) Condition: The Organization receives funding for the Nevada Ready! program through the State of Nevada and the amount of funding provided by federal and state sources changes annually. The Organization did not identify that certain information required to be communicated for federally sourced awards was missing from the information provided to subrecipients for subawards they received during the year. Context: Nineteen preschool centers did not receive notification that the funding they received included funds that were federally sourced and additional information required to be communicated related to the federal funding was not provided. Cause: The design and implementation of internal controls over subrecipient monitoring was not effective. Effect: Not communicating the inclusion of federal funding in a subaward and all related requirements in a subaward to subrecipients could result in the subrecipients not complying with federal regulations. Recommendation: We recommend management design and implement a system of internal controls whereby every subaward that includes federal funding be clearly identified to the subrecipient as a federal subaward and include all data elements required to be provided to the subrecipient at the time of the subaward and if any of the data elements change, include the changes in a subsequent subaward modification. Views of Responsible Officials and Planned Corrective Action: We appreciate the identification of this compliance issue and are committed to addressing the finding with a robust corrective action plan. The following steps outline the measures we will take to ensure compliance with federal requirements for subrecipient monitoring under 2 CFR 200.332, effective June 30, 2024, and related guidance: 1. Implementation of Updated Grant Award Communication Procedures Future Grants to Centers: - We will estimate the amount of federal funds included in each grant and include this amount in the agreement at the time of award issuance. - Agreements will be updated to clearly delineate the specific requirements for both federal and state funds. - Each Center will acknowledge their responsibilities and obligations for federal and state funds, with detailed requirements provided for both funding sources. Annual Notifications: - A statement will be provided to each Center annually, clearly notifying them of the amount of federal funding included in their subaward. 2. Prioritization of FY24 Subrecipients - Upon receipt of these findings, immediate focus was placed on Nonprofit Centers, and we confirmed that none received more than $749,999 in federal awards (either directly as a recipient or indirectly as a subrecipient) in aggregate for all its projects during the fiscal year. - A statement will be provided to each Center annually, clearly notifying them of the amount of federal funding included in their subaward. - The corrective actions will be implemented by January 31, 2025. 3. FY25 Proactive Measures - Notifications of federal requirements and the Q1 statement for FY25 will be distributed by January 31, 2025. - We conducted an initial high-level overview of these updated requirements at the Director Training on November 15, 2024. - A comprehensive training session will follow in January 2025 to ensure all subrecipients fully understand their obligations under Uniform Guidance, including subaward identification and compliance monitoring. 4. Alignment with 2 CFR 200.332 Requirements for Pass-Through Entities In compliance with the updated requirements for pass-through entities under 2 CFR 200.332: - Each subaward will be clearly identified as a federal subaward and include all required data elements at the time of issuance. Any subsequent changes will be communicated through a formal subaward modification process. - Indirect cost rate requirements under 2 CFR 200.332 (i) will be explicitly addressed. Specifically: If the subrecipient has an approved federally recognized indirect cost rate, it will be honored. If no approved rate exists, we will collaborate with the subrecipient to determine an appropriate rate. This may include using a previously negotiated rate between the subrecipient and another pass-through entity, without requiring additional justification from the subrecipient. Current Status: Corrective action has been implemented.
Criteria: Subrecipient Monitoring - Non-profit entities must follow the requirements for pass-through entities set out at 2 CFR part 200.332. Condition: Lack of documentation of subrecipient monitoring including risk assessment and whether the subrecipient is disqualified. Also, there as no indication of notification of the federal award identification number and amount of federal funds. Cause: The Organization has established policies over subrecipient monitoring and federal award identification in accordance with 2 CFR 200.332(b); however, methods for documentation of certain monitoring procedures are not formally established. Also, method for documentation of communication on federal award identification number and amount of federal funds is not contained within subaward notification on the subaward notice. Effect: The Organization does not have adequate documentation evidencing subrecipient monitoring procedures were performed or that all required information relating to federal awards was provided to subrecipients. Context: A sample of three disbursements totaling $95,377 were tested from a population of 14 transactions totaling $127,079. Questioned costs: No known or likely questioned cost in excess of $25,000. Repeat Finding: No Recommendation: We recommend the Organization establish a formal methodology for documenting subrecipient monitoring and adhere to its policies for communicating federal award identification in accordance with 2 CFR 200.332. Views of responsible officials of the auditee: The Organization concurs with the finding and will implement the following: Develop additional policies and procedures that require documentation of subrecipient monitoring including a risk assessment for each subrecipient Revise all federal subrecipient contracts to include federal award identification number and the amount of federal funds awarded to each subrecipient Distribute policies and procedures and contract templates to all applicable finance and programmatic staff Train staff on the new policies and procedures
2024-001 Internal Control over Compliance and Compliance with Period of Performance Identification of the Federal Program: United States Department of Justice Assistance Listing Number: 16.726 Assistance Listing Name: Juvenile Mentoring Program Grant Award Number: 15PJDP-21-GG-02766-MENT Award Period: October 1, 2021 through June 30, 2024 Criteria or Specific Requirement: §200.303 Internal Controls states that a non-federal entity must (a) establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Per 2 CFR Section 200.1 Period of performance means the time during which the non–Federal entity may incur new obligations to carry out the work authorized under the Federal award. The Federal awarding agency or pass-through entity must include start and end dates of the period of performance in the Federal award (see Sections 200.211 Information contained in a Federal award paragraph (b)(5) and 200.332 Requirements for pass-through entities, paragraph (b)(1)(v)). Condition: During the audit, we tested Council’s period of performance of subrecipient costs. We noted that Council has documented policies and procedures to comply with period of performance requirements and in all twenty-four samples tested complied with the prime award period of performance. However, in one sample out of twenty-four tested, Council paid the subrecipient $1,322 for expenses that were incurred after the subaward period of performance. Upon identifying this condition in our audit procedures, Council management determined that a total of $5,635 was paid to the subrecipient for costs incurred after the end of the subaward period of performance. Cause: Council did not follow its process to execute a no-cost extension of the subaward period of performance before approving reimbursement for costs incurred by the subrecipient during the prime award’s period of performance. Effect: The lack of adherence to the established internal control policies and procedures can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements which could ultimately lead to disallowed costs for the major federal program. Questioned Costs: There are questioned costs totaling $5,635. Context: This is a condition based on testing of Council’s compliance with specified requirements. The prevalence of the finding is detailed in the condition section above. The samples were selected using a non-statistical method. Repeat Finding: This is not a repeat finding. Recommendation: BDO recommends that Council follows its processes to ensure only subrecipient costs incurred during an active subgrant period of performance are reimbursed. Views of Responsible Officials: Council management agrees with the finding and recommendations set forth within and will work with program management teams to provide guidance and training related to subrecipient organization period of performance. Refer to management’s corrective action plan for additional information.
FINDING 2024-002 Subject: PPHF Geriatric Education Centers - Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program: PPHF Geriatric Education Centers Assistance Listings Number: 93.969 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Other Matters Condition and Context The University expended $831,232 in PPHF Geriatric Education Centers funds during the audit period. Of that amount, $309,264 was passed through to three subrecipients. As a pass-through entity, the University was required to identify the award and applicable requirements and monitor the subrecipient. Procedures to monitor its subrecipients included the following: Reviewing financial and programmatic reports as required by the University. Following up and ensuring the subrecipient takes timely and appropriate actions on all deficiencies pertaining to the federal award provided to the subrecipient detected through audits, on-site reviews, and other means. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient. INDIANA STATE BOARD OF ACCOUNTS 17 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Two of the three subrecipients expended more than $750,000 in federal awards in fiscal year 2023, thus subjecting each to a Single Audit as required by the Uniform Guidance. As such, both subrecipients were required to submit a Single Audit report to the Federal Audit Clearinghouse (FAC) by March 31, 2024. The University should have expected that the two subrecipients would receive a Single Audit report as both subrecipients were subject to a Single Audit for multiple years leading up to 2023. However, the University did not obtain a copy of either subrecipient's 2023 Single Audit report. Obtaining and reviewing Single Audit reports of subrecipients is a required component of conducting proper monitoring of subrecipients. The lack of proper monitoring would not have allowed the University to follow up and ensure that the subrecipients took timely and appropriate action on all deficiencies pertaining to the federal awards passed through to the subrecipients from the University. In addition, it would not have allowed for the University to issue a management decision for audit findings pertaining to the federal award provided to the subrecipient within six months of acceptance by the FAC. The lack of effective internal controls was a systemic issue throughout the audit period. The noncompliance was isolated to two of the University's three subrecipients during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states in part: "All pass-through entities must: . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: . . . (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. . . ." INDIANA STATE BOARD OF ACCOUNTS 18 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 200.521(d) states in part: ". . . The federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The University's management had not designed or implemented a system of internal controls to ensure that subrecipient audit reports were received and reviewed. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As a result, subrecipients to whom payments were made were not adequately monitored. The failure to establish a sufficient system of internal controls allowed noncompliance with the grant agreements and the Subrecipient Monitoring compliance requirement. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management establish a system of internal controls to ensure that subrecipient audit reports are received and reviewed, when required, to ensure that subrecipients are properly monitored in accordance with the federal regulations. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
2024-087: Review Subrecipient Audit Reports Applicable to: Department of Health Prior Year Finding Number: N/A Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) - 93.323; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises - 93.391 Federal Award Number and Year: Various - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.331(d) Known Questioned Costs: $0 Health does not monitor subrecipients in accordance with federal regulations for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) and Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises federal grant programs. During our audit, we found that Health’s Office of Epidemiology (Epidemiology) and the Office of Health Equity (OHE) did not obtain and review a Single Audit or program-specific audit report for subrecipients who received $750,000 or more in subawards from ELC and STLT funds. During fiscal year 2024, Health disbursed approximately $11 million in ELC funds and $5.8 million in STLT funds to subrecipients. According to Title 2 U.S. Code of Federal Regulations (CFR) § 200.332(f), all pass-through entities must verify their subrecipients are audited if it is expected that the subrecipient’s federal awards expended during the respective fiscal year will equal or exceed $750,000. Additionally, in the case of any findings, 2 CFR § 200.332(d)(3) requires pass-through entities to issue a management decision within six months of acceptance of the audit report by the Federal Audit Clearinghouse (Clearinghouse). Due to significant turnover in contract administrators responsible for subrecipient monitoring, Epidemiology and OHE were unable to provide evidence that staff reviewed Single Audit or program-specific audit reports for all subrecipients expending $750,000 or more during fiscal year 2024. In addition, OFM did not have a current subrecipient monitoring policy and procedure in place to detect subrecipients that met the audit threshold. Health last updated its subrecipient monitoring policy in 2014. Without obtaining the appropriate reports, Health is unable to show it is meeting the requirements set forth in 2 CFR part 200, subpart F, which includes issuing a management decision on audit findings within six months after receipt of the subrecipient’s audit report and ensuring that the subrecipient takes timely and appropriate corrective action on all audit findings. OFM should update its subrecipient monitoring policy and communicate the policy to the applicable offices and districts. In addition, OFM should periodically review the Clearinghouse to determine whether subrecipients who meet the audit threshold obtain the required audits, and that the applicable offices or districts are reviewing the audit reports and considering the impact of any deficiencies identified in audit findings. Epidemiology and OHE should ensure staff review Single Audit or program-specific audit reports for subrecipients who meet the audit threshold and should adhere to all federal requirements when conducting monitoring over such subrecipients. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-087: Review Subrecipient Audit Reports Applicable to: Department of Health Prior Year Finding Number: N/A Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) - 93.323; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises - 93.391 Federal Award Number and Year: Various - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.331(d) Known Questioned Costs: $0 Health does not monitor subrecipients in accordance with federal regulations for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) and Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises federal grant programs. During our audit, we found that Health’s Office of Epidemiology (Epidemiology) and the Office of Health Equity (OHE) did not obtain and review a Single Audit or program-specific audit report for subrecipients who received $750,000 or more in subawards from ELC and STLT funds. During fiscal year 2024, Health disbursed approximately $11 million in ELC funds and $5.8 million in STLT funds to subrecipients. According to Title 2 U.S. Code of Federal Regulations (CFR) § 200.332(f), all pass-through entities must verify their subrecipients are audited if it is expected that the subrecipient’s federal awards expended during the respective fiscal year will equal or exceed $750,000. Additionally, in the case of any findings, 2 CFR § 200.332(d)(3) requires pass-through entities to issue a management decision within six months of acceptance of the audit report by the Federal Audit Clearinghouse (Clearinghouse). Due to significant turnover in contract administrators responsible for subrecipient monitoring, Epidemiology and OHE were unable to provide evidence that staff reviewed Single Audit or program-specific audit reports for all subrecipients expending $750,000 or more during fiscal year 2024. In addition, OFM did not have a current subrecipient monitoring policy and procedure in place to detect subrecipients that met the audit threshold. Health last updated its subrecipient monitoring policy in 2014. Without obtaining the appropriate reports, Health is unable to show it is meeting the requirements set forth in 2 CFR part 200, subpart F, which includes issuing a management decision on audit findings within six months after receipt of the subrecipient’s audit report and ensuring that the subrecipient takes timely and appropriate corrective action on all audit findings. OFM should update its subrecipient monitoring policy and communicate the policy to the applicable offices and districts. In addition, OFM should periodically review the Clearinghouse to determine whether subrecipients who meet the audit threshold obtain the required audits, and that the applicable offices or districts are reviewing the audit reports and considering the impact of any deficiencies identified in audit findings. Epidemiology and OHE should ensure staff review Single Audit or program-specific audit reports for subrecipients who meet the audit threshold and should adhere to all federal requirements when conducting monitoring over such subrecipients. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-087: Review Subrecipient Audit Reports Applicable to: Department of Health Prior Year Finding Number: N/A Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) - 93.323; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises - 93.391 Federal Award Number and Year: Various - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.331(d) Known Questioned Costs: $0 Health does not monitor subrecipients in accordance with federal regulations for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) and Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises federal grant programs. During our audit, we found that Health’s Office of Epidemiology (Epidemiology) and the Office of Health Equity (OHE) did not obtain and review a Single Audit or program-specific audit report for subrecipients who received $750,000 or more in subawards from ELC and STLT funds. During fiscal year 2024, Health disbursed approximately $11 million in ELC funds and $5.8 million in STLT funds to subrecipients. According to Title 2 U.S. Code of Federal Regulations (CFR) § 200.332(f), all pass-through entities must verify their subrecipients are audited if it is expected that the subrecipient’s federal awards expended during the respective fiscal year will equal or exceed $750,000. Additionally, in the case of any findings, 2 CFR § 200.332(d)(3) requires pass-through entities to issue a management decision within six months of acceptance of the audit report by the Federal Audit Clearinghouse (Clearinghouse). Due to significant turnover in contract administrators responsible for subrecipient monitoring, Epidemiology and OHE were unable to provide evidence that staff reviewed Single Audit or program-specific audit reports for all subrecipients expending $750,000 or more during fiscal year 2024. In addition, OFM did not have a current subrecipient monitoring policy and procedure in place to detect subrecipients that met the audit threshold. Health last updated its subrecipient monitoring policy in 2014. Without obtaining the appropriate reports, Health is unable to show it is meeting the requirements set forth in 2 CFR part 200, subpart F, which includes issuing a management decision on audit findings within six months after receipt of the subrecipient’s audit report and ensuring that the subrecipient takes timely and appropriate corrective action on all audit findings. OFM should update its subrecipient monitoring policy and communicate the policy to the applicable offices and districts. In addition, OFM should periodically review the Clearinghouse to determine whether subrecipients who meet the audit threshold obtain the required audits, and that the applicable offices or districts are reviewing the audit reports and considering the impact of any deficiencies identified in audit findings. Epidemiology and OHE should ensure staff review Single Audit or program-specific audit reports for subrecipients who meet the audit threshold and should adhere to all federal requirements when conducting monitoring over such subrecipients. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-087: Review Subrecipient Audit Reports Applicable to: Department of Health Prior Year Finding Number: N/A Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) - 93.323; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises - 93.391 Federal Award Number and Year: Various - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.331(d) Known Questioned Costs: $0 Health does not monitor subrecipients in accordance with federal regulations for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) and Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises federal grant programs. During our audit, we found that Health’s Office of Epidemiology (Epidemiology) and the Office of Health Equity (OHE) did not obtain and review a Single Audit or program-specific audit report for subrecipients who received $750,000 or more in subawards from ELC and STLT funds. During fiscal year 2024, Health disbursed approximately $11 million in ELC funds and $5.8 million in STLT funds to subrecipients. According to Title 2 U.S. Code of Federal Regulations (CFR) § 200.332(f), all pass-through entities must verify their subrecipients are audited if it is expected that the subrecipient’s federal awards expended during the respective fiscal year will equal or exceed $750,000. Additionally, in the case of any findings, 2 CFR § 200.332(d)(3) requires pass-through entities to issue a management decision within six months of acceptance of the audit report by the Federal Audit Clearinghouse (Clearinghouse). Due to significant turnover in contract administrators responsible for subrecipient monitoring, Epidemiology and OHE were unable to provide evidence that staff reviewed Single Audit or program-specific audit reports for all subrecipients expending $750,000 or more during fiscal year 2024. In addition, OFM did not have a current subrecipient monitoring policy and procedure in place to detect subrecipients that met the audit threshold. Health last updated its subrecipient monitoring policy in 2014. Without obtaining the appropriate reports, Health is unable to show it is meeting the requirements set forth in 2 CFR part 200, subpart F, which includes issuing a management decision on audit findings within six months after receipt of the subrecipient’s audit report and ensuring that the subrecipient takes timely and appropriate corrective action on all audit findings. OFM should update its subrecipient monitoring policy and communicate the policy to the applicable offices and districts. In addition, OFM should periodically review the Clearinghouse to determine whether subrecipients who meet the audit threshold obtain the required audits, and that the applicable offices or districts are reviewing the audit reports and considering the impact of any deficiencies identified in audit findings. Epidemiology and OHE should ensure staff review Single Audit or program-specific audit reports for subrecipients who meet the audit threshold and should adhere to all federal requirements when conducting monitoring over such subrecipients. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-087: Review Subrecipient Audit Reports Applicable to: Department of Health Prior Year Finding Number: N/A Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) - 93.323; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises - 93.391 Federal Award Number and Year: Various - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.331(d) Known Questioned Costs: $0 Health does not monitor subrecipients in accordance with federal regulations for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) and Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises federal grant programs. During our audit, we found that Health’s Office of Epidemiology (Epidemiology) and the Office of Health Equity (OHE) did not obtain and review a Single Audit or program-specific audit report for subrecipients who received $750,000 or more in subawards from ELC and STLT funds. During fiscal year 2024, Health disbursed approximately $11 million in ELC funds and $5.8 million in STLT funds to subrecipients. According to Title 2 U.S. Code of Federal Regulations (CFR) § 200.332(f), all pass-through entities must verify their subrecipients are audited if it is expected that the subrecipient’s federal awards expended during the respective fiscal year will equal or exceed $750,000. Additionally, in the case of any findings, 2 CFR § 200.332(d)(3) requires pass-through entities to issue a management decision within six months of acceptance of the audit report by the Federal Audit Clearinghouse (Clearinghouse). Due to significant turnover in contract administrators responsible for subrecipient monitoring, Epidemiology and OHE were unable to provide evidence that staff reviewed Single Audit or program-specific audit reports for all subrecipients expending $750,000 or more during fiscal year 2024. In addition, OFM did not have a current subrecipient monitoring policy and procedure in place to detect subrecipients that met the audit threshold. Health last updated its subrecipient monitoring policy in 2014. Without obtaining the appropriate reports, Health is unable to show it is meeting the requirements set forth in 2 CFR part 200, subpart F, which includes issuing a management decision on audit findings within six months after receipt of the subrecipient’s audit report and ensuring that the subrecipient takes timely and appropriate corrective action on all audit findings. OFM should update its subrecipient monitoring policy and communicate the policy to the applicable offices and districts. In addition, OFM should periodically review the Clearinghouse to determine whether subrecipients who meet the audit threshold obtain the required audits, and that the applicable offices or districts are reviewing the audit reports and considering the impact of any deficiencies identified in audit findings. Epidemiology and OHE should ensure staff review Single Audit or program-specific audit reports for subrecipients who meet the audit threshold and should adhere to all federal requirements when conducting monitoring over such subrecipients. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-087: Review Subrecipient Audit Reports Applicable to: Department of Health Prior Year Finding Number: N/A Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) - 93.323; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises - 93.391 Federal Award Number and Year: Various - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.331(d) Known Questioned Costs: $0 Health does not monitor subrecipients in accordance with federal regulations for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) and Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises federal grant programs. During our audit, we found that Health’s Office of Epidemiology (Epidemiology) and the Office of Health Equity (OHE) did not obtain and review a Single Audit or program-specific audit report for subrecipients who received $750,000 or more in subawards from ELC and STLT funds. During fiscal year 2024, Health disbursed approximately $11 million in ELC funds and $5.8 million in STLT funds to subrecipients. According to Title 2 U.S. Code of Federal Regulations (CFR) § 200.332(f), all pass-through entities must verify their subrecipients are audited if it is expected that the subrecipient’s federal awards expended during the respective fiscal year will equal or exceed $750,000. Additionally, in the case of any findings, 2 CFR § 200.332(d)(3) requires pass-through entities to issue a management decision within six months of acceptance of the audit report by the Federal Audit Clearinghouse (Clearinghouse). Due to significant turnover in contract administrators responsible for subrecipient monitoring, Epidemiology and OHE were unable to provide evidence that staff reviewed Single Audit or program-specific audit reports for all subrecipients expending $750,000 or more during fiscal year 2024. In addition, OFM did not have a current subrecipient monitoring policy and procedure in place to detect subrecipients that met the audit threshold. Health last updated its subrecipient monitoring policy in 2014. Without obtaining the appropriate reports, Health is unable to show it is meeting the requirements set forth in 2 CFR part 200, subpart F, which includes issuing a management decision on audit findings within six months after receipt of the subrecipient’s audit report and ensuring that the subrecipient takes timely and appropriate corrective action on all audit findings. OFM should update its subrecipient monitoring policy and communicate the policy to the applicable offices and districts. In addition, OFM should periodically review the Clearinghouse to determine whether subrecipients who meet the audit threshold obtain the required audits, and that the applicable offices or districts are reviewing the audit reports and considering the impact of any deficiencies identified in audit findings. Epidemiology and OHE should ensure staff review Single Audit or program-specific audit reports for subrecipients who meet the audit threshold and should adhere to all federal requirements when conducting monitoring over such subrecipients. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-083: Ensure Subaward Agreements Meet Federal Regulations Applicable to: Department of Social Services Prior Year Finding Number: N/A Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Temporary Assistance for Needy Families (TANF) - 93.558 Federal Award Number and Year: 2401VATANF - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(a)(1) Known Questioned Costs: $0 Social Services does not include all information required by federal regulations in its subaward renewal agreements. We tested 20 subaward renewal agreements and noted that all of them did not contain one or more of the elements required by 2 CFR § 200.332(a)(1). Specifically, we noted the following instances of non-compliance in these subaward renewal agreements: Social Services did not include the correct Federal Award Identification Number (FAIN) in 15 of the 20 (75%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(iii). Social Services did not include the federal award date in eight of the 20 (40%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(iv). Social Services did not update the federal award date in 12 of the 20 (60%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(iv). Social Services did not include the FAIN in five of the 20 (25%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(iii). Social Services did not include the amount of federal funds obligated in the subaward in four of the 20 (20%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(vii). Social Services did not include the subrecipient’s unique entity identifier in four of the 20 (20%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(ii). Social Services did not include the contact information for the awarding official of the pass-through entity in four of the 20 (20%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(xi). Social Services did not identify whether the federal award was for research and development in four of the 20 (20%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(xiii). Social Services did not include the federal award project description in two of the 20 (10%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(x). Social Services did not accurately report the name of the federal awarding agency in two of the 20 (10%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(xi). Social Services did not include the Assistance Listing Number in one of the 20 (5%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(xii). Social Services did not identify the indirect cost rate for the federal award in one of the 20 (5%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(xiv). During fiscal year 2024, Social Services disbursed approximately $46 million in federal funds from the TANF federal grant program through 238 subawards. While Social Services communicates federal award information to subgrantees, it does not consistently communicate all of the federal grant award information required in its subaward renewal agreements. The Contract and Procurement team within Social Services’ Division of General Services works collaboratively with grants administrators when preparing subaward agreements. However, the Contract and Procurement team has experienced turnover over the last several years and has lost institutional knowledge in some of its key positions as it pertains to federal grant requirements. Additionally, the Contract and Procurement team does not consistently retain all incorporated attachments in the subaward agreement. Compliance is responsible for ensuring that the agency adheres to federal regulations in 2 CFR § 200.332 through its Agency Monitoring Plan; however, Compliance was not aware of these instances of non-compliance because it was not involved in the preparation of the subaward agreements. According to Social Services’ Organizational Structure Report, Compliance is responsible for agency-wide compliance and risk mitigation that helps ensure adherence to state and federal legal and regulatory standards. Because of the lack of agency-wide collaboration, there were inconsistencies in the information included in the subaward agreements. Without communicating the required federal award information, Social Services increases the risk that subrecipients are unaware of the source of the funding and the applicable requirements, which increases the potential for unallowable costs and non-compliance with federal requirements. Compliance should work collaboratively with the Contract and Procurement team and grants administrators to ensure that subaward agreements include all information required by federal regulations. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-084: Review Non-Locality Subrecipient Single Audit Reports Applicable to: Department of Social Services Prior Year Finding Number: 2023-098; 2022-013; 2021-072; 2020-075; 2019-091; 2018-092 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Temporary Assistance for Needy Families (TANF) - 93.558 Federal Award Number and Year: 2401VATANF - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(d)(3); 2 CFR § 200.332(f) Known Questioned Costs: $0 Compliance continues to not review non-locality subrecipient Single Audit reports as set forth within its Agency Monitoring Plan. Non-locality subrecipients are subrecipients who are not local governments and are mainly comprised of non-profit organizations. During fiscal year 2024, Social Services disbursed approximately $107 million in federal funds to 244 non-locality subrecipients. While reviewing the Single Audit reports submitted to the Federal Audit Clearinghouse (Clearinghouse) for the most recent audit period for the 27 non-locality subrecipients that received more than $750,000 in federal funds from Social Services during state fiscal year 2024, we noted the following: Six non-locality subrecipients (22%) did not have a Single Audit report available in the Clearinghouse for the most recent audit period. Of the six non-locality subrecipients, three appeared to have never submitted a Single Audit report to the Clearinghouse. Title 2 CFR § 200.332(f) requires pass-through entities to verify their subrecipients are audited if it is expected that the subrecipient’s federal awards expended during the respective fiscal year equaled or exceeded $750,000. Three non-locality subrecipients (11%) had audit findings that affected at least one of Social Services’ federal grant programs. One of the non-locality subrecipient auditors identified $82,253 in known questioned costs as the non-locality subrecipient did not maintain proper documentation to support payroll charges to the TANF federal grant program. Title 2 U.S. CFR § 200.332(d)(3) requires pass-through entities to issue a management decision within six months of acceptance of the audit report by the Clearinghouse. A management decision is Social Services’ written determination, provided to its subrecipient, of the adequacy of the subrecipient’s proposed corrective actions to address the audit findings, based on Social Services’ evaluation of the audit findings, including determining if the questioned costs are disallowed and need to be repaid to the federal awarding agency, and proposed corrective actions. As part of its planned corrective action, Compliance stated that it intends to procure a grants management system with subrecipient monitoring capabilities necessary to comply with federal requirements and has worked with Social Services’ Executive Team to secure funding. However, Compliance has yet to establish a timeline for when it intends for the solution to be fully functional. Additionally, Compliance has not evaluated what alternative corrective actions are available to become compliant. According to Social Services’ Organizational Structure Report, Compliance is responsible for agency-wide compliance and risk mitigation that helps ensure adherence to state and federal legal and regulatory standards. Additionally, Social Services’ Agency Monitoring Plan assigns the responsibility to Compliance for overseeing the agency’s subrecipient monitoring process. Without verifying whether non-locality subrecipients received a Single Audit, Compliance is unable to assure Social Services’ Executive Team that it is fulfilling the pass-through entity responsibilities in 2 CFR § 200.332. Not complying with federal regulations could result in federal awarding agencies temporarily withholding payments until it takes corrective action, disallowing costs for all or part of the activity associated with the noncompliance, suspending, or terminating the federal award in part or in its entirety, initiating initial suspension or debarment proceedings, and/or withholding further federal funds for the project or program. Further, Social Services may be unaware of a potential liability to the Commonwealth by not reviewing the non-locality Single Audit reports. Compliance should consider exploring alternative corrective actions as it continues to develop and implement its grants management system, such as obtaining a list of non-locality subrecipients from its internal accounting system and reviewing the Single Audit reports in the Clearinghouse. Evaluating alternative corrective actions to become compliant with federal regulations will help Social Services mitigate the risks of incurring federal sanctions. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-085: Evaluate Subrecipients’ Risk of Noncompliance in Accordance with Federal Regulations Applicable to: Department of Social Services Prior Year Finding Number: 2023-100; 2022-016; 2021-071 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(b) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants evaluated each subrecipient’s risk of noncompliance in accordance with federal regulations. Benefit Programs oversees the administration of the Medicaid, SNAP, TANF, and LIHEAP federal grant programs. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Additionally, Benefit Programs partnered with program consultants to perform risk assessment procedures. While auditing Benefit Programs’ fiscal year 2024 subrecipient monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Program consultants did not complete non-locality programmatic risk assessments for 219 out of 251 (87%) subawards with payments during the fiscal year. Program consultants did not include adequate justification for why it would not perform a monitoring review during the monitoring period for 83 out of 274 (30%) locality programmatic risk assessments assessed as high or medium risk. Program consultants did not complete 50 out of 324 (15%) locality programmatic risk assessments. Program consultants assessed three of the non-locality subrecipients as moderate risk without an adequate justification of why a monitoring review would not be scheduled for these non-locality subrecipients. Program consultants improperly assessed two of the non-locality subrecipients as low risk even though they had never submitted a Single Audit report to the Clearinghouse. Program consultants did not include a locality programmatic risk assessment that was identified as requiring a targeted monitoring review in their schedule for the fiscal year. Title 2 CFR § 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Without performing the proper risk assessment procedures, Benefit Programs cannot demonstrate that it monitored the activities of the subrecipients as necessary to ensure that the pass-through entities used the subawards for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Benefit Programs was not able to adequately oversee the implementation of its risk assessment processes due to turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants complete risk assessment procedures for all of its subrecipients in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-086: Confirm Monitoring Activities are Conducted in Accordance with the Monitoring Plan Applicable to: Department of Social Services Prior Year Finding Number: 2023-102; 2022-014 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(d) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants performed all required subrecipient monitoring activities in accordance with its subrecipient monitoring plan. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Further, Benefit Programs partnered with program consultants to execute its subrecipient monitoring activities. While auditing Benefit Programs’ fiscal year 2024 monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Benefit Programs did not confirm program consultants notified the locality timely about the subrecipient monitoring review process. As a result, Benefit Programs did not identify that program consultants did not initiate timely communications for five out of 19 (26%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants fully documented corrective actions taken by its subrecipients in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide fully documented corrective action plans for four out of 19 (21%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants uploaded all fiscal year 2024 monitoring review records to its data repository in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide complete documentation for three out of 19 (16%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants included the appropriate sampling units, as outlined in its subrecipient monitoring plan. As a result, Benefit Programs did not identify that three out of 19 (16%) locality monitoring reviews had less sampling units than required by its subrecipient monitoring plan. Benefit Programs did not confirm that program consultants performed all scheduled monitoring reviews. As a result, Benefit Programs did not identify that program consultants did not perform a scheduled monitoring review for one out of 19 (5%) of its locality subrecipients. Based on Benefit Programs’ subrecipient monitoring risk assessments, this locality review was necessary due to the presence of risk factors which created a higher risk of non-compliance. Benefit Programs has not fully implemented its non-locality risk assessment and monitoring review processes which caused program consultants to perform only one monitoring review over approximately 251 non-locality subawards with payments during the fiscal year. Title 2 CFR § 200.332(e) requires the pass-through entity to monitor the activities of the subrecipient as necessary to ensure that the subrecipient uses the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Without confirming that program consultants conducted monitoring activities in accordance with the monitoring plan, Benefit Programs cannot provide assurance that it complied with federal regulations and potentially places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards. Benefit Programs was not able to adequately oversee the execution of monitoring activities because of turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants are performing monitoring procedures in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-083: Ensure Subaward Agreements Meet Federal Regulations Applicable to: Department of Social Services Prior Year Finding Number: N/A Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Temporary Assistance for Needy Families (TANF) - 93.558 Federal Award Number and Year: 2401VATANF - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(a)(1) Known Questioned Costs: $0 Social Services does not include all information required by federal regulations in its subaward renewal agreements. We tested 20 subaward renewal agreements and noted that all of them did not contain one or more of the elements required by 2 CFR § 200.332(a)(1). Specifically, we noted the following instances of non-compliance in these subaward renewal agreements: Social Services did not include the correct Federal Award Identification Number (FAIN) in 15 of the 20 (75%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(iii). Social Services did not include the federal award date in eight of the 20 (40%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(iv). Social Services did not update the federal award date in 12 of the 20 (60%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(iv). Social Services did not include the FAIN in five of the 20 (25%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(iii). Social Services did not include the amount of federal funds obligated in the subaward in four of the 20 (20%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(vii). Social Services did not include the subrecipient’s unique entity identifier in four of the 20 (20%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(ii). Social Services did not include the contact information for the awarding official of the pass-through entity in four of the 20 (20%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(xi). Social Services did not identify whether the federal award was for research and development in four of the 20 (20%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(xiii). Social Services did not include the federal award project description in two of the 20 (10%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(x). Social Services did not accurately report the name of the federal awarding agency in two of the 20 (10%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(xi). Social Services did not include the Assistance Listing Number in one of the 20 (5%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(xii). Social Services did not identify the indirect cost rate for the federal award in one of the 20 (5%) subaward renewal agreements, as required by 2 CFR § 200.332(a)(1)(xiv). During fiscal year 2024, Social Services disbursed approximately $46 million in federal funds from the TANF federal grant program through 238 subawards. While Social Services communicates federal award information to subgrantees, it does not consistently communicate all of the federal grant award information required in its subaward renewal agreements. The Contract and Procurement team within Social Services’ Division of General Services works collaboratively with grants administrators when preparing subaward agreements. However, the Contract and Procurement team has experienced turnover over the last several years and has lost institutional knowledge in some of its key positions as it pertains to federal grant requirements. Additionally, the Contract and Procurement team does not consistently retain all incorporated attachments in the subaward agreement. Compliance is responsible for ensuring that the agency adheres to federal regulations in 2 CFR § 200.332 through its Agency Monitoring Plan; however, Compliance was not aware of these instances of non-compliance because it was not involved in the preparation of the subaward agreements. According to Social Services’ Organizational Structure Report, Compliance is responsible for agency-wide compliance and risk mitigation that helps ensure adherence to state and federal legal and regulatory standards. Because of the lack of agency-wide collaboration, there were inconsistencies in the information included in the subaward agreements. Without communicating the required federal award information, Social Services increases the risk that subrecipients are unaware of the source of the funding and the applicable requirements, which increases the potential for unallowable costs and non-compliance with federal requirements. Compliance should work collaboratively with the Contract and Procurement team and grants administrators to ensure that subaward agreements include all information required by federal regulations. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-084: Review Non-Locality Subrecipient Single Audit Reports Applicable to: Department of Social Services Prior Year Finding Number: 2023-098; 2022-013; 2021-072; 2020-075; 2019-091; 2018-092 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Temporary Assistance for Needy Families (TANF) - 93.558 Federal Award Number and Year: 2401VATANF - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(d)(3); 2 CFR § 200.332(f) Known Questioned Costs: $0 Compliance continues to not review non-locality subrecipient Single Audit reports as set forth within its Agency Monitoring Plan. Non-locality subrecipients are subrecipients who are not local governments and are mainly comprised of non-profit organizations. During fiscal year 2024, Social Services disbursed approximately $107 million in federal funds to 244 non-locality subrecipients. While reviewing the Single Audit reports submitted to the Federal Audit Clearinghouse (Clearinghouse) for the most recent audit period for the 27 non-locality subrecipients that received more than $750,000 in federal funds from Social Services during state fiscal year 2024, we noted the following: Six non-locality subrecipients (22%) did not have a Single Audit report available in the Clearinghouse for the most recent audit period. Of the six non-locality subrecipients, three appeared to have never submitted a Single Audit report to the Clearinghouse. Title 2 CFR § 200.332(f) requires pass-through entities to verify their subrecipients are audited if it is expected that the subrecipient’s federal awards expended during the respective fiscal year equaled or exceeded $750,000. Three non-locality subrecipients (11%) had audit findings that affected at least one of Social Services’ federal grant programs. One of the non-locality subrecipient auditors identified $82,253 in known questioned costs as the non-locality subrecipient did not maintain proper documentation to support payroll charges to the TANF federal grant program. Title 2 U.S. CFR § 200.332(d)(3) requires pass-through entities to issue a management decision within six months of acceptance of the audit report by the Clearinghouse. A management decision is Social Services’ written determination, provided to its subrecipient, of the adequacy of the subrecipient’s proposed corrective actions to address the audit findings, based on Social Services’ evaluation of the audit findings, including determining if the questioned costs are disallowed and need to be repaid to the federal awarding agency, and proposed corrective actions. As part of its planned corrective action, Compliance stated that it intends to procure a grants management system with subrecipient monitoring capabilities necessary to comply with federal requirements and has worked with Social Services’ Executive Team to secure funding. However, Compliance has yet to establish a timeline for when it intends for the solution to be fully functional. Additionally, Compliance has not evaluated what alternative corrective actions are available to become compliant. According to Social Services’ Organizational Structure Report, Compliance is responsible for agency-wide compliance and risk mitigation that helps ensure adherence to state and federal legal and regulatory standards. Additionally, Social Services’ Agency Monitoring Plan assigns the responsibility to Compliance for overseeing the agency’s subrecipient monitoring process. Without verifying whether non-locality subrecipients received a Single Audit, Compliance is unable to assure Social Services’ Executive Team that it is fulfilling the pass-through entity responsibilities in 2 CFR § 200.332. Not complying with federal regulations could result in federal awarding agencies temporarily withholding payments until it takes corrective action, disallowing costs for all or part of the activity associated with the noncompliance, suspending, or terminating the federal award in part or in its entirety, initiating initial suspension or debarment proceedings, and/or withholding further federal funds for the project or program. Further, Social Services may be unaware of a potential liability to the Commonwealth by not reviewing the non-locality Single Audit reports. Compliance should consider exploring alternative corrective actions as it continues to develop and implement its grants management system, such as obtaining a list of non-locality subrecipients from its internal accounting system and reviewing the Single Audit reports in the Clearinghouse. Evaluating alternative corrective actions to become compliant with federal regulations will help Social Services mitigate the risks of incurring federal sanctions. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-085: Evaluate Subrecipients’ Risk of Noncompliance in Accordance with Federal Regulations Applicable to: Department of Social Services Prior Year Finding Number: 2023-100; 2022-016; 2021-071 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(b) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants evaluated each subrecipient’s risk of noncompliance in accordance with federal regulations. Benefit Programs oversees the administration of the Medicaid, SNAP, TANF, and LIHEAP federal grant programs. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Additionally, Benefit Programs partnered with program consultants to perform risk assessment procedures. While auditing Benefit Programs’ fiscal year 2024 subrecipient monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Program consultants did not complete non-locality programmatic risk assessments for 219 out of 251 (87%) subawards with payments during the fiscal year. Program consultants did not include adequate justification for why it would not perform a monitoring review during the monitoring period for 83 out of 274 (30%) locality programmatic risk assessments assessed as high or medium risk. Program consultants did not complete 50 out of 324 (15%) locality programmatic risk assessments. Program consultants assessed three of the non-locality subrecipients as moderate risk without an adequate justification of why a monitoring review would not be scheduled for these non-locality subrecipients. Program consultants improperly assessed two of the non-locality subrecipients as low risk even though they had never submitted a Single Audit report to the Clearinghouse. Program consultants did not include a locality programmatic risk assessment that was identified as requiring a targeted monitoring review in their schedule for the fiscal year. Title 2 CFR § 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Without performing the proper risk assessment procedures, Benefit Programs cannot demonstrate that it monitored the activities of the subrecipients as necessary to ensure that the pass-through entities used the subawards for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Benefit Programs was not able to adequately oversee the implementation of its risk assessment processes due to turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants complete risk assessment procedures for all of its subrecipients in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-086: Confirm Monitoring Activities are Conducted in Accordance with the Monitoring Plan Applicable to: Department of Social Services Prior Year Finding Number: 2023-102; 2022-014 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(d) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants performed all required subrecipient monitoring activities in accordance with its subrecipient monitoring plan. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Further, Benefit Programs partnered with program consultants to execute its subrecipient monitoring activities. While auditing Benefit Programs’ fiscal year 2024 monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Benefit Programs did not confirm program consultants notified the locality timely about the subrecipient monitoring review process. As a result, Benefit Programs did not identify that program consultants did not initiate timely communications for five out of 19 (26%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants fully documented corrective actions taken by its subrecipients in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide fully documented corrective action plans for four out of 19 (21%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants uploaded all fiscal year 2024 monitoring review records to its data repository in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide complete documentation for three out of 19 (16%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants included the appropriate sampling units, as outlined in its subrecipient monitoring plan. As a result, Benefit Programs did not identify that three out of 19 (16%) locality monitoring reviews had less sampling units than required by its subrecipient monitoring plan. Benefit Programs did not confirm that program consultants performed all scheduled monitoring reviews. As a result, Benefit Programs did not identify that program consultants did not perform a scheduled monitoring review for one out of 19 (5%) of its locality subrecipients. Based on Benefit Programs’ subrecipient monitoring risk assessments, this locality review was necessary due to the presence of risk factors which created a higher risk of non-compliance. Benefit Programs has not fully implemented its non-locality risk assessment and monitoring review processes which caused program consultants to perform only one monitoring review over approximately 251 non-locality subawards with payments during the fiscal year. Title 2 CFR § 200.332(e) requires the pass-through entity to monitor the activities of the subrecipient as necessary to ensure that the subrecipient uses the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Without confirming that program consultants conducted monitoring activities in accordance with the monitoring plan, Benefit Programs cannot provide assurance that it complied with federal regulations and potentially places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards. Benefit Programs was not able to adequately oversee the execution of monitoring activities because of turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants are performing monitoring procedures in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-085: Evaluate Subrecipients’ Risk of Noncompliance in Accordance with Federal Regulations Applicable to: Department of Social Services Prior Year Finding Number: 2023-100; 2022-016; 2021-071 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(b) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants evaluated each subrecipient’s risk of noncompliance in accordance with federal regulations. Benefit Programs oversees the administration of the Medicaid, SNAP, TANF, and LIHEAP federal grant programs. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Additionally, Benefit Programs partnered with program consultants to perform risk assessment procedures. While auditing Benefit Programs’ fiscal year 2024 subrecipient monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Program consultants did not complete non-locality programmatic risk assessments for 219 out of 251 (87%) subawards with payments during the fiscal year. Program consultants did not include adequate justification for why it would not perform a monitoring review during the monitoring period for 83 out of 274 (30%) locality programmatic risk assessments assessed as high or medium risk. Program consultants did not complete 50 out of 324 (15%) locality programmatic risk assessments. Program consultants assessed three of the non-locality subrecipients as moderate risk without an adequate justification of why a monitoring review would not be scheduled for these non-locality subrecipients. Program consultants improperly assessed two of the non-locality subrecipients as low risk even though they had never submitted a Single Audit report to the Clearinghouse. Program consultants did not include a locality programmatic risk assessment that was identified as requiring a targeted monitoring review in their schedule for the fiscal year. Title 2 CFR § 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Without performing the proper risk assessment procedures, Benefit Programs cannot demonstrate that it monitored the activities of the subrecipients as necessary to ensure that the pass-through entities used the subawards for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Benefit Programs was not able to adequately oversee the implementation of its risk assessment processes due to turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants complete risk assessment procedures for all of its subrecipients in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-086: Confirm Monitoring Activities are Conducted in Accordance with the Monitoring Plan Applicable to: Department of Social Services Prior Year Finding Number: 2023-102; 2022-014 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(d) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants performed all required subrecipient monitoring activities in accordance with its subrecipient monitoring plan. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Further, Benefit Programs partnered with program consultants to execute its subrecipient monitoring activities. While auditing Benefit Programs’ fiscal year 2024 monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Benefit Programs did not confirm program consultants notified the locality timely about the subrecipient monitoring review process. As a result, Benefit Programs did not identify that program consultants did not initiate timely communications for five out of 19 (26%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants fully documented corrective actions taken by its subrecipients in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide fully documented corrective action plans for four out of 19 (21%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants uploaded all fiscal year 2024 monitoring review records to its data repository in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide complete documentation for three out of 19 (16%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants included the appropriate sampling units, as outlined in its subrecipient monitoring plan. As a result, Benefit Programs did not identify that three out of 19 (16%) locality monitoring reviews had less sampling units than required by its subrecipient monitoring plan. Benefit Programs did not confirm that program consultants performed all scheduled monitoring reviews. As a result, Benefit Programs did not identify that program consultants did not perform a scheduled monitoring review for one out of 19 (5%) of its locality subrecipients. Based on Benefit Programs’ subrecipient monitoring risk assessments, this locality review was necessary due to the presence of risk factors which created a higher risk of non-compliance. Benefit Programs has not fully implemented its non-locality risk assessment and monitoring review processes which caused program consultants to perform only one monitoring review over approximately 251 non-locality subawards with payments during the fiscal year. Title 2 CFR § 200.332(e) requires the pass-through entity to monitor the activities of the subrecipient as necessary to ensure that the subrecipient uses the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Without confirming that program consultants conducted monitoring activities in accordance with the monitoring plan, Benefit Programs cannot provide assurance that it complied with federal regulations and potentially places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards. Benefit Programs was not able to adequately oversee the execution of monitoring activities because of turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants are performing monitoring procedures in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-085: Evaluate Subrecipients’ Risk of Noncompliance in Accordance with Federal Regulations Applicable to: Department of Social Services Prior Year Finding Number: 2023-100; 2022-016; 2021-071 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(b) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants evaluated each subrecipient’s risk of noncompliance in accordance with federal regulations. Benefit Programs oversees the administration of the Medicaid, SNAP, TANF, and LIHEAP federal grant programs. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Additionally, Benefit Programs partnered with program consultants to perform risk assessment procedures. While auditing Benefit Programs’ fiscal year 2024 subrecipient monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Program consultants did not complete non-locality programmatic risk assessments for 219 out of 251 (87%) subawards with payments during the fiscal year. Program consultants did not include adequate justification for why it would not perform a monitoring review during the monitoring period for 83 out of 274 (30%) locality programmatic risk assessments assessed as high or medium risk. Program consultants did not complete 50 out of 324 (15%) locality programmatic risk assessments. Program consultants assessed three of the non-locality subrecipients as moderate risk without an adequate justification of why a monitoring review would not be scheduled for these non-locality subrecipients. Program consultants improperly assessed two of the non-locality subrecipients as low risk even though they had never submitted a Single Audit report to the Clearinghouse. Program consultants did not include a locality programmatic risk assessment that was identified as requiring a targeted monitoring review in their schedule for the fiscal year. Title 2 CFR § 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Without performing the proper risk assessment procedures, Benefit Programs cannot demonstrate that it monitored the activities of the subrecipients as necessary to ensure that the pass-through entities used the subawards for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Benefit Programs was not able to adequately oversee the implementation of its risk assessment processes due to turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants complete risk assessment procedures for all of its subrecipients in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-086: Confirm Monitoring Activities are Conducted in Accordance with the Monitoring Plan Applicable to: Department of Social Services Prior Year Finding Number: 2023-102; 2022-014 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(d) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants performed all required subrecipient monitoring activities in accordance with its subrecipient monitoring plan. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Further, Benefit Programs partnered with program consultants to execute its subrecipient monitoring activities. While auditing Benefit Programs’ fiscal year 2024 monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Benefit Programs did not confirm program consultants notified the locality timely about the subrecipient monitoring review process. As a result, Benefit Programs did not identify that program consultants did not initiate timely communications for five out of 19 (26%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants fully documented corrective actions taken by its subrecipients in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide fully documented corrective action plans for four out of 19 (21%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants uploaded all fiscal year 2024 monitoring review records to its data repository in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide complete documentation for three out of 19 (16%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants included the appropriate sampling units, as outlined in its subrecipient monitoring plan. As a result, Benefit Programs did not identify that three out of 19 (16%) locality monitoring reviews had less sampling units than required by its subrecipient monitoring plan. Benefit Programs did not confirm that program consultants performed all scheduled monitoring reviews. As a result, Benefit Programs did not identify that program consultants did not perform a scheduled monitoring review for one out of 19 (5%) of its locality subrecipients. Based on Benefit Programs’ subrecipient monitoring risk assessments, this locality review was necessary due to the presence of risk factors which created a higher risk of non-compliance. Benefit Programs has not fully implemented its non-locality risk assessment and monitoring review processes which caused program consultants to perform only one monitoring review over approximately 251 non-locality subawards with payments during the fiscal year. Title 2 CFR § 200.332(e) requires the pass-through entity to monitor the activities of the subrecipient as necessary to ensure that the subrecipient uses the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Without confirming that program consultants conducted monitoring activities in accordance with the monitoring plan, Benefit Programs cannot provide assurance that it complied with federal regulations and potentially places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards. Benefit Programs was not able to adequately oversee the execution of monitoring activities because of turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants are performing monitoring procedures in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-082: Perform Responsibilities Outlined in the Agency Monitoring Plan Applicable to: Department of Social Services Prior Year Finding Number: 2023-097; 2022-011; 2021-070; 2020-074; 2019-090; 2018-093 Type of Finding: Internal Control and Compliance Severity of Deficiency: Material Weakness Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778 Federal Award Number and Year: 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.303(a); 2 CFR § 200.332 Known Questioned Costs: $0 Compliance continues to not adhere to its established approach to oversee the agency’s subrecipient monitoring activities, as outlined in its Agency Monitoring Plan. According to Social Services’ Organizational Structure Report, Compliance is responsible for agency-wide compliance and risk mitigation that helps to ensure adherence to state and federal legal and regulatory standards, including subrecipient monitoring. During fiscal year 2024, Social Services disbursed approximately $660 million to 342 subrecipients from 30 federal grant programs. During the audit, we noted the following deviations from the Agency Monitoring Plan: Compliance continues to not review programmatic division annual subrecipient monitoring plans to ensure they implement a risk-based approach. The Agency Monitoring Plan states that Compliance will use a Monitoring Plan Checklist to evaluate and determine if all the required elements for subrecipient monitoring are present in each division’s plan. Compliance does not hold monthly meetings with Subrecipient Monitoring Coordinators, as required by the Agency Monitoring Plan, where divisions can share information concerning risks and federal and/or grant-specific requirements, approaches to assessing risk, and changes that could affect subrecipients and the monitoring processes. Compliance has not reviewed each division’s monitoring activities nor provided quarterly reports of variances and noncompliance from the Agency Monitoring Plan to Social Services’ executive team. As a result, Compliance did not identify that the Division of Benefit Programs (Benefit Programs) did not complete risk assessments for 50 of its 324 (15%) locality subrecipients, properly document considerations for localities with elevated risks, nor perform adequate risk assessments for their non-locality subrecipients. Since the prior audit, Compliance has communicated the Agency Monitoring Plan to the Subrecipient Monitoring Coordinators. Additionally, Compliance has worked with Social Services’ Executive Team to secure funding for a grants management system and additional subrecipient monitor positions. However, Compliance has yet to establish a timeline for when it intends for the system to be fully functional and has not explored alternate options to comply with its Agency Monitoring Plan. Further, Compliance has not collaborated with Subrecipient Monitoring Coordinators to determine how the agency collectively plans to accomplish the goals and objectives set forth within the Agency Monitoring Plan. Collaboration between Compliance and Subrecipient Monitoring Coordinators is imperative to ensuring that Social Services complies with the pass-through entity requirements in 2 CFR § 200.332. Title 2 CFR § 200.303(a) requires pass-through entities to establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Without performing the responsibilities in the Agency Monitoring Plan, Compliance cannot assure that the agency’s subrecipient monitoring efforts are adequate to comply with the regulations at 2 CFR § 200.332. Additionally, Compliance places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards by not monitoring the agency’s subrecipient monitoring activities. Because of the scope of this matter and the magnitude of Social Services’ subrecipient monitoring responsibilities, we consider these weaknesses collectively to create a material weakness in internal controls over compliance. Compliance should work collaboratively with Social Services’ Executive Team and the subrecipient monitoring coordinators to fulfil the agency’s responsibilities in the Agency Monitoring Plan. Further, Compliance should explore alternative solutions to track and monitor each division’s subrecipient monitoring activities and report the results to the Executive Team until it develops and implements its grants management system. Evaluating alternative solutions will help Social Services mitigate the risk of incurring federal sanctions because of non-compliance. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-085: Evaluate Subrecipients’ Risk of Noncompliance in Accordance with Federal Regulations Applicable to: Department of Social Services Prior Year Finding Number: 2023-100; 2022-016; 2021-071 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(b) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants evaluated each subrecipient’s risk of noncompliance in accordance with federal regulations. Benefit Programs oversees the administration of the Medicaid, SNAP, TANF, and LIHEAP federal grant programs. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Additionally, Benefit Programs partnered with program consultants to perform risk assessment procedures. While auditing Benefit Programs’ fiscal year 2024 subrecipient monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Program consultants did not complete non-locality programmatic risk assessments for 219 out of 251 (87%) subawards with payments during the fiscal year. Program consultants did not include adequate justification for why it would not perform a monitoring review during the monitoring period for 83 out of 274 (30%) locality programmatic risk assessments assessed as high or medium risk. Program consultants did not complete 50 out of 324 (15%) locality programmatic risk assessments. Program consultants assessed three of the non-locality subrecipients as moderate risk without an adequate justification of why a monitoring review would not be scheduled for these non-locality subrecipients. Program consultants improperly assessed two of the non-locality subrecipients as low risk even though they had never submitted a Single Audit report to the Clearinghouse. Program consultants did not include a locality programmatic risk assessment that was identified as requiring a targeted monitoring review in their schedule for the fiscal year. Title 2 CFR § 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Without performing the proper risk assessment procedures, Benefit Programs cannot demonstrate that it monitored the activities of the subrecipients as necessary to ensure that the pass-through entities used the subawards for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Benefit Programs was not able to adequately oversee the implementation of its risk assessment processes due to turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants complete risk assessment procedures for all of its subrecipients in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-086: Confirm Monitoring Activities are Conducted in Accordance with the Monitoring Plan Applicable to: Department of Social Services Prior Year Finding Number: 2023-102; 2022-014 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(d) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants performed all required subrecipient monitoring activities in accordance with its subrecipient monitoring plan. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Further, Benefit Programs partnered with program consultants to execute its subrecipient monitoring activities. While auditing Benefit Programs’ fiscal year 2024 monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Benefit Programs did not confirm program consultants notified the locality timely about the subrecipient monitoring review process. As a result, Benefit Programs did not identify that program consultants did not initiate timely communications for five out of 19 (26%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants fully documented corrective actions taken by its subrecipients in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide fully documented corrective action plans for four out of 19 (21%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants uploaded all fiscal year 2024 monitoring review records to its data repository in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide complete documentation for three out of 19 (16%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants included the appropriate sampling units, as outlined in its subrecipient monitoring plan. As a result, Benefit Programs did not identify that three out of 19 (16%) locality monitoring reviews had less sampling units than required by its subrecipient monitoring plan. Benefit Programs did not confirm that program consultants performed all scheduled monitoring reviews. As a result, Benefit Programs did not identify that program consultants did not perform a scheduled monitoring review for one out of 19 (5%) of its locality subrecipients. Based on Benefit Programs’ subrecipient monitoring risk assessments, this locality review was necessary due to the presence of risk factors which created a higher risk of non-compliance. Benefit Programs has not fully implemented its non-locality risk assessment and monitoring review processes which caused program consultants to perform only one monitoring review over approximately 251 non-locality subawards with payments during the fiscal year. Title 2 CFR § 200.332(e) requires the pass-through entity to monitor the activities of the subrecipient as necessary to ensure that the subrecipient uses the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Without confirming that program consultants conducted monitoring activities in accordance with the monitoring plan, Benefit Programs cannot provide assurance that it complied with federal regulations and potentially places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards. Benefit Programs was not able to adequately oversee the execution of monitoring activities because of turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants are performing monitoring procedures in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-082: Perform Responsibilities Outlined in the Agency Monitoring Plan Applicable to: Department of Social Services Prior Year Finding Number: 2023-097; 2022-011; 2021-070; 2020-074; 2019-090; 2018-093 Type of Finding: Internal Control and Compliance Severity of Deficiency: Material Weakness Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778 Federal Award Number and Year: 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.303(a); 2 CFR § 200.332 Known Questioned Costs: $0 Compliance continues to not adhere to its established approach to oversee the agency’s subrecipient monitoring activities, as outlined in its Agency Monitoring Plan. According to Social Services’ Organizational Structure Report, Compliance is responsible for agency-wide compliance and risk mitigation that helps to ensure adherence to state and federal legal and regulatory standards, including subrecipient monitoring. During fiscal year 2024, Social Services disbursed approximately $660 million to 342 subrecipients from 30 federal grant programs. During the audit, we noted the following deviations from the Agency Monitoring Plan: Compliance continues to not review programmatic division annual subrecipient monitoring plans to ensure they implement a risk-based approach. The Agency Monitoring Plan states that Compliance will use a Monitoring Plan Checklist to evaluate and determine if all the required elements for subrecipient monitoring are present in each division’s plan. Compliance does not hold monthly meetings with Subrecipient Monitoring Coordinators, as required by the Agency Monitoring Plan, where divisions can share information concerning risks and federal and/or grant-specific requirements, approaches to assessing risk, and changes that could affect subrecipients and the monitoring processes. Compliance has not reviewed each division’s monitoring activities nor provided quarterly reports of variances and noncompliance from the Agency Monitoring Plan to Social Services’ executive team. As a result, Compliance did not identify that the Division of Benefit Programs (Benefit Programs) did not complete risk assessments for 50 of its 324 (15%) locality subrecipients, properly document considerations for localities with elevated risks, nor perform adequate risk assessments for their non-locality subrecipients. Since the prior audit, Compliance has communicated the Agency Monitoring Plan to the Subrecipient Monitoring Coordinators. Additionally, Compliance has worked with Social Services’ Executive Team to secure funding for a grants management system and additional subrecipient monitor positions. However, Compliance has yet to establish a timeline for when it intends for the system to be fully functional and has not explored alternate options to comply with its Agency Monitoring Plan. Further, Compliance has not collaborated with Subrecipient Monitoring Coordinators to determine how the agency collectively plans to accomplish the goals and objectives set forth within the Agency Monitoring Plan. Collaboration between Compliance and Subrecipient Monitoring Coordinators is imperative to ensuring that Social Services complies with the pass-through entity requirements in 2 CFR § 200.332. Title 2 CFR § 200.303(a) requires pass-through entities to establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Without performing the responsibilities in the Agency Monitoring Plan, Compliance cannot assure that the agency’s subrecipient monitoring efforts are adequate to comply with the regulations at 2 CFR § 200.332. Additionally, Compliance places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards by not monitoring the agency’s subrecipient monitoring activities. Because of the scope of this matter and the magnitude of Social Services’ subrecipient monitoring responsibilities, we consider these weaknesses collectively to create a material weakness in internal controls over compliance. Compliance should work collaboratively with Social Services’ Executive Team and the subrecipient monitoring coordinators to fulfil the agency’s responsibilities in the Agency Monitoring Plan. Further, Compliance should explore alternative solutions to track and monitor each division’s subrecipient monitoring activities and report the results to the Executive Team until it develops and implements its grants management system. Evaluating alternative solutions will help Social Services mitigate the risk of incurring federal sanctions because of non-compliance. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-085: Evaluate Subrecipients’ Risk of Noncompliance in Accordance with Federal Regulations Applicable to: Department of Social Services Prior Year Finding Number: 2023-100; 2022-016; 2021-071 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(b) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants evaluated each subrecipient’s risk of noncompliance in accordance with federal regulations. Benefit Programs oversees the administration of the Medicaid, SNAP, TANF, and LIHEAP federal grant programs. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Additionally, Benefit Programs partnered with program consultants to perform risk assessment procedures. While auditing Benefit Programs’ fiscal year 2024 subrecipient monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Program consultants did not complete non-locality programmatic risk assessments for 219 out of 251 (87%) subawards with payments during the fiscal year. Program consultants did not include adequate justification for why it would not perform a monitoring review during the monitoring period for 83 out of 274 (30%) locality programmatic risk assessments assessed as high or medium risk. Program consultants did not complete 50 out of 324 (15%) locality programmatic risk assessments. Program consultants assessed three of the non-locality subrecipients as moderate risk without an adequate justification of why a monitoring review would not be scheduled for these non-locality subrecipients. Program consultants improperly assessed two of the non-locality subrecipients as low risk even though they had never submitted a Single Audit report to the Clearinghouse. Program consultants did not include a locality programmatic risk assessment that was identified as requiring a targeted monitoring review in their schedule for the fiscal year. Title 2 CFR § 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Without performing the proper risk assessment procedures, Benefit Programs cannot demonstrate that it monitored the activities of the subrecipients as necessary to ensure that the pass-through entities used the subawards for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Benefit Programs was not able to adequately oversee the implementation of its risk assessment processes due to turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants complete risk assessment procedures for all of its subrecipients in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-086: Confirm Monitoring Activities are Conducted in Accordance with the Monitoring Plan Applicable to: Department of Social Services Prior Year Finding Number: 2023-102; 2022-014 Type of Finding: Internal Control and Compliance Severity of Deficiency: Significant Deficiency Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778; Temporary Assistance for Needy Families (TANF) - 93.558; Low-Income Home Energy Assistance Program (LIHEAP) - 93.568 Federal Award Number and Year: 2401VATANF; 2401VALIEA; 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.332(d) Known Questioned Costs: $0 Benefit Programs did not confirm that program consultants performed all required subrecipient monitoring activities in accordance with its subrecipient monitoring plan. During fiscal year 2024, Social Services disbursed approximately $660 million in federal funds to roughly 342 subrecipients from 30 federal grant programs. As part of its fiscal year 2024 corrective action efforts, Benefit Programs updated its monitoring plan to include risk assessment and monitoring reviews for both localities and non-localities subrecipients, began performing locality and non-locality risk assessments, and created tracking documents to better manage the subrecipient monitoring process. Further, Benefit Programs partnered with program consultants to execute its subrecipient monitoring activities. While auditing Benefit Programs’ fiscal year 2024 monitoring activities, we noted the following deviations from its subrecipient monitoring plan: Benefit Programs did not confirm program consultants notified the locality timely about the subrecipient monitoring review process. As a result, Benefit Programs did not identify that program consultants did not initiate timely communications for five out of 19 (26%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants fully documented corrective actions taken by its subrecipients in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide fully documented corrective action plans for four out of 19 (21%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants uploaded all fiscal year 2024 monitoring review records to its data repository in accordance with its subrecipient monitoring plan. As a result, Benefit Programs was not able to provide complete documentation for three out of 19 (16%) scheduled locality monitoring reviews. Benefit Programs did not confirm that program consultants included the appropriate sampling units, as outlined in its subrecipient monitoring plan. As a result, Benefit Programs did not identify that three out of 19 (16%) locality monitoring reviews had less sampling units than required by its subrecipient monitoring plan. Benefit Programs did not confirm that program consultants performed all scheduled monitoring reviews. As a result, Benefit Programs did not identify that program consultants did not perform a scheduled monitoring review for one out of 19 (5%) of its locality subrecipients. Based on Benefit Programs’ subrecipient monitoring risk assessments, this locality review was necessary due to the presence of risk factors which created a higher risk of non-compliance. Benefit Programs has not fully implemented its non-locality risk assessment and monitoring review processes which caused program consultants to perform only one monitoring review over approximately 251 non-locality subawards with payments during the fiscal year. Title 2 CFR § 200.332(e) requires the pass-through entity to monitor the activities of the subrecipient as necessary to ensure that the subrecipient uses the subaward for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Without confirming that program consultants conducted monitoring activities in accordance with the monitoring plan, Benefit Programs cannot provide assurance that it complied with federal regulations and potentially places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards. Benefit Programs was not able to adequately oversee the execution of monitoring activities because of turnover in its subrecipient monitoring coordinator position. Additionally, Social Services’ Compliance Division was not aware of this non-compliance because it was not performing its monitoring responsibilities in accordance with its Agency Monitoring Plan. Benefit Programs should continue to evaluate its resource levels to ensure that it has adequate resources to effectively oversee the execution of its subrecipient monitoring plan. Additionally, Benefit Programs should dedicate the necessary resources to confirm that program consultants are performing monitoring procedures in accordance with its subrecipient monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2024-082: Perform Responsibilities Outlined in the Agency Monitoring Plan Applicable to: Department of Social Services Prior Year Finding Number: 2023-097; 2022-011; 2021-070; 2020-074; 2019-090; 2018-093 Type of Finding: Internal Control and Compliance Severity of Deficiency: Material Weakness Information System Security Control Family: N/A ALPT or Cluster Name and ALN: Medicaid Cluster - 93.775, 93.777, 93.778 Federal Award Number and Year: 2405VA5MAP - 2024 Name of Federal Agency: U.S. Department of Health and Human Services Type of Compliance Requirement - Criteria: Subrecipient Monitoring - 2 CFR § 200.303(a); 2 CFR § 200.332 Known Questioned Costs: $0 Compliance continues to not adhere to its established approach to oversee the agency’s subrecipient monitoring activities, as outlined in its Agency Monitoring Plan. According to Social Services’ Organizational Structure Report, Compliance is responsible for agency-wide compliance and risk mitigation that helps to ensure adherence to state and federal legal and regulatory standards, including subrecipient monitoring. During fiscal year 2024, Social Services disbursed approximately $660 million to 342 subrecipients from 30 federal grant programs. During the audit, we noted the following deviations from the Agency Monitoring Plan: Compliance continues to not review programmatic division annual subrecipient monitoring plans to ensure they implement a risk-based approach. The Agency Monitoring Plan states that Compliance will use a Monitoring Plan Checklist to evaluate and determine if all the required elements for subrecipient monitoring are present in each division’s plan. Compliance does not hold monthly meetings with Subrecipient Monitoring Coordinators, as required by the Agency Monitoring Plan, where divisions can share information concerning risks and federal and/or grant-specific requirements, approaches to assessing risk, and changes that could affect subrecipients and the monitoring processes. Compliance has not reviewed each division’s monitoring activities nor provided quarterly reports of variances and noncompliance from the Agency Monitoring Plan to Social Services’ executive team. As a result, Compliance did not identify that the Division of Benefit Programs (Benefit Programs) did not complete risk assessments for 50 of its 324 (15%) locality subrecipients, properly document considerations for localities with elevated risks, nor perform adequate risk assessments for their non-locality subrecipients. Since the prior audit, Compliance has communicated the Agency Monitoring Plan to the Subrecipient Monitoring Coordinators. Additionally, Compliance has worked with Social Services’ Executive Team to secure funding for a grants management system and additional subrecipient monitor positions. However, Compliance has yet to establish a timeline for when it intends for the system to be fully functional and has not explored alternate options to comply with its Agency Monitoring Plan. Further, Compliance has not collaborated with Subrecipient Monitoring Coordinators to determine how the agency collectively plans to accomplish the goals and objectives set forth within the Agency Monitoring Plan. Collaboration between Compliance and Subrecipient Monitoring Coordinators is imperative to ensuring that Social Services complies with the pass-through entity requirements in 2 CFR § 200.332. Title 2 CFR § 200.303(a) requires pass-through entities to establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the non-Federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Without performing the responsibilities in the Agency Monitoring Plan, Compliance cannot assure that the agency’s subrecipient monitoring efforts are adequate to comply with the regulations at 2 CFR § 200.332. Additionally, Compliance places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards by not monitoring the agency’s subrecipient monitoring activities. Because of the scope of this matter and the magnitude of Social Services’ subrecipient monitoring responsibilities, we consider these weaknesses collectively to create a material weakness in internal controls over compliance. Compliance should work collaboratively with Social Services’ Executive Team and the subrecipient monitoring coordinators to fulfil the agency’s responsibilities in the Agency Monitoring Plan. Further, Compliance should explore alternative solutions to track and monitor each division’s subrecipient monitoring activities and report the results to the Executive Team until it develops and implements its grants management system. Evaluating alternative solutions will help Social Services mitigate the risk of incurring federal sanctions because of non-compliance. Views of Responsible Officials: The views of responsible officials are included in the report related to their applicable organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.